backend/src/config/index.ts

@@ -1,3 +1,4 @@
+import { AES_GCM_AUTH_TAG_BYTE_LENGTH } from '../consts/crypto/aesGcmAuthTagByteLength';
 import { AltchaConfig } from '../types/config/AltchaConfig';
 import { AppConfig } from '../types/config/AppConfig';
 import { NodeEnv } from '../types/NodeEnv';
@@ -34,7 +35,6 @@ export const getAltchaConfig = (): AltchaConfig => {
 };
 
 export const getAppConfig = (): AppConfig => {
-    const aesGcmCiphertextOverheadBytes = 16;
     const jsonBase64ByteRatioNumerator = 4;
     const jsonBase64ByteRatioDenominator = 3;
 
@@ -61,7 +61,7 @@ export const getAppConfig = (): AppConfig => {
             upload: {
                 maxViewsMax: envInt('VALIDATION_UPLOAD_MAX_VIEWS_MAX'),
                 maxImageBytes,
-                maxCiphertextBytes: maxImageBytes + aesGcmCiphertextOverheadBytes,
+                maxCiphertextBytes: maxImageBytes + AES_GCM_AUTH_TAG_BYTE_LENGTH,
                 maxRequestBodyBytes:
                     Math.ceil((maxImageBytes * jsonBase64ByteRatioNumerator) / jsonBase64ByteRatioDenominator) +
                     jsonBodyPaddingBytes

backend/src/consts/crypto/aesGcmAuthTagByteLength.ts

@@ -0,0 +1 @@
+export const AES_GCM_AUTH_TAG_BYTE_LENGTH = 16;

backend/src/consts/crypto/aesGcmIvByteLength.ts

@@ -0,0 +1 @@
+export const AES_GCM_IV_BYTE_LENGTH = 12;

backend/src/modules/upload/dto/CreateZkUploadDto.ts

@@ -1,4 +1,5 @@
 import { IsBoolean, IsNotEmpty, ValidateIf } from 'class-validator';
+import { AES_GCM_IV_BYTE_LENGTH } from '../../../consts/crypto/aesGcmIvByteLength';
 import { IsBase64 } from '../../../validation/decorators/isBase64';
 import { UploadCiphertextOptionsDto } from './UploadCiphertextOptionsDto';
 
@@ -14,7 +15,7 @@ export class CreateZkUploadDto extends UploadCiphertextOptionsDto {
 
     @ValidateIf((dto: CreateZkUploadDto) => dto.passwordProtected === true)
     @IsNotEmpty()
-    @IsBase64({ byteLength: 12 })
+    @IsBase64({ byteLength: AES_GCM_IV_BYTE_LENGTH })
     wrapIv?: string;
 
     @ValidateIf((dto: CreateZkUploadDto) => dto.passwordProtected === true)

backend/src/modules/upload/dto/UploadCiphertextOptionsDto.ts

@@ -1,4 +1,5 @@
 import { IsNotEmpty } from 'class-validator';
+import { AES_GCM_IV_BYTE_LENGTH } from '../../../consts/crypto/aesGcmIvByteLength';
 import { getAppConfig } from '../../../config';
 import { IsBase64 } from '../../../validation/decorators/isBase64';
 import { UploadOptionsDto } from './UploadOptionsDto';
@@ -11,7 +12,7 @@ const {
 
 export class UploadCiphertextOptionsDto extends UploadOptionsDto {
     @IsNotEmpty()
-    @IsBase64({ byteLength: 12 })
+    @IsBase64({ byteLength: AES_GCM_IV_BYTE_LENGTH })
     iv: string;
 
     @IsNotEmpty()