Creating a SEB Configuration File with JavaScript

[tzahiba]

Hello,
My firm has started using SEB, and it looking for a way to create the .seb files our selves, and since we are using a Node.JS Backend, I am looking for a way to use that to create the .seb configurations.
As I understood, the unencrypted version of the file is XML, so i would be able to recreate that file in no problem, But i dont really understand the encryptions on the way.

Is there anything out there that can set an example of what i should do?

Thanks.

[danschlet]

See: https://www.safeexambrowser.org/developer/overview.html
Particularly https://www.safeexambrowser.org/developer/seb-file-format.html
The RNCryptor framework used for proper AES encryption is also available for Javascript.

[trombonekenny]

I have a proof of concept that's maturing; I should have code to point you to in a few weeks of generating and customizing .SEB files from a NodeJS/Express framework.

The libraries do all of the heavy lifting for you, so it's just plugging things in. I'm using plist, zlib, jscryptor

[tzahiba]

@danschlet I have seen that, And cant use RNCRyptor because of the linux libraries that are dependent of them.

@trombonekenny
Regarding jsencryptor, would i encrypt it just as it is read?
refernecing this:

1.Generate a random encryption salt
2.Generate the encryption key using PBKDF2 (see your language docs for how to call this). Pass the password as a string, the random encryption salt, and 10,000 iterations.
3.Generate a random HMAC salt
4.Generate the HMAC key using PBKDF2 (see your language docs for how to call this). Pass the password as a string, the random HMAC salt, and 10,000 iterations.
5.Generate a random IV
6.Encrypt the data using the encryption key (above), the IV (above), AES-256, and the CBC mode. This is the default mode for almost all AES encryption libraries.
7.Pass your ciphertext to an HMAC function, along with the HMAC key (above), and the PRF "SHA-256" (see your library's docs for what the names of the PRF functions are; this might also be called "SHA-2, 256-bits").
8.Put these elements together in the format given above.

And the Data Format, do i need to encrypt every key seperately? I didn't really understand.

[trombonekenny]

For password encryption, here's what my code is doing. I think most of things you're stuck on are just handled by jscryptor.Encrypt -- it's code is pretty easy to read if you want to confirm it.

// compress the config
var SEBinner= zlib.gzipSync(plist.build(SEBconfig));
// Encrypt with password
var SEBencrypted = jscryptor.Encrypt(SEBinner, 'reallysecretpassWord');
// Add the header
var SEBheader = Buffer.from('pswd', 'utf8');
// Compress it all up again
var SEBfile = Buffer.concat([SEBheader, Buffer.from(SEBencrypted, 'base64')]);

return res.send(zlib.gzipSync(SEBfile));

[ScottDellinger]

Hi Dave! I tried your suggested code, but am getting an error with the plist library. Did you ever get it working? I'm using this inside a node.js Lambda function on AWS if that makes a difference.

Thanks in advance!

[trombonekenny]

I haven't looked at that code in a few years. We stalled on SEB because we had more students testing from their own devices, rather than our labs where we have more control and feel more comfortable supporting SEB. plist should be pretty straightforward turning a JS object into the plist XML? What's the error?

[tzahiba]

@trombonekenny Thanks alot!
Just regarding my last question, do u just encrypt the whole config and put it in the Data Format specified?

[trombonekenny]

I'm not sure I understand your question. You encrypt the whole config that's been gzipped. Then you add a small text header at the front and gzip it again.

[tzahiba]

@trombonekenny Thank you so much man, that helped me ALOT!