Decrypting appends invalid characters to message

Hey, I try to encrypt and decrypt JSON using the simple secretbox method, here is what I got:

import { secretbox, randomBytes } from 'tweetnacl';
import { decodeUTF8, encodeUTF8, encodeBase64, decodeBase64 } from 'tweetnacl-util';

const newNonce = () => randomBytes(secretbox.nonceLength);

export const generateKey = () => encodeBase64(randomBytes(secretbox.keyLength));

export const encrypt = (json, password) => {
  const passwordUint8Array = decodeBase64(password);

  const nonce = newNonce();
  const messageUint8 = decodeUTF8(JSON.stringify(json));
  const box = secretbox(messageUint8, nonce, passwordUint8Array);

  const fullMessage = new Uint8Array(nonce.length + box.length);
  fullMessage.set(nonce);
  fullMessage.set(messageUint8, nonce.length);

  const base64FullMessage = encodeBase64(fullMessage);
  return base64FullMessage;
};

export const decrypt = (messageWithNonce, password) => {
  const passwordUint8Array = decodeBase64(password);
  const messageWithNonceAsUint8Array = decodeBase64(messageWithNonce);
  const nonce = messageWithNonceAsUint8Array.slice(0, secretbox.nonceLength);
  const message = messageWithNonceAsUint8Array.slice(
    secretbox.nonceLength,
    messageWithNonce.length,
  );

  const box = secretbox(message, nonce, passwordUint8Array);
  const decrypted = secretbox.open(box, nonce, passwordUint8Array);

  const base64DecryptedMessage = encodeUTF8(decrypted);
  return JSON.parse(base64DecryptedMessage.substr(0, base64DecryptedMessage.lastIndexOf('}') + 1));
};

As you can see at the very bottom, I’m creating a substr of the decrypted message, since at the end, there is always some invisible, invalid characters. Any idea of why?

Does the rest seem alright? Maybe it would be a good usage example.

Thanks!

[bkniffler]

Wow, that was stupid, thanks @dchest!

Here the full working example for anyone stumbling over this:

import { secretbox, randomBytes } from "tweetnacl";
import {
  decodeUTF8,
  encodeUTF8,
  encodeBase64,
  decodeBase64
} from "tweetnacl-util";

const newNonce = () => randomBytes(secretbox.nonceLength);

export const generateKey = () => encodeBase64(randomBytes(secretbox.keyLength));

export const encrypt = (json, key) => {
  const keyUint8Array = decodeBase64(key);

  const nonce = newNonce();
  const messageUint8 = decodeUTF8(JSON.stringify(json));
  const box = secretbox(messageUint8, nonce, keyUint8Array);

  const fullMessage = new Uint8Array(nonce.length + box.length);
  fullMessage.set(nonce);
  fullMessage.set(box, nonce.length);

  const base64FullMessage = encodeBase64(fullMessage);
  return base64FullMessage;
};

export const decrypt = (messageWithNonce, key) => {
  const keyUint8Array = decodeBase64(key);
  const messageWithNonceAsUint8Array = decodeBase64(messageWithNonce);
  const nonce = messageWithNonceAsUint8Array.slice(0, secretbox.nonceLength);
  const message = messageWithNonceAsUint8Array.slice(
    secretbox.nonceLength,
    messageWithNonce.length
  );

  const decrypted = secretbox.open(message, nonce, keyUint8Array);

  if (!decrypted) {
    throw new Error("Could not decrypt message");
  }

  const base64DecryptedMessage = encodeUTF8(decrypted);
  return JSON.parse(base64DecryptedMessage);
};

[bkniffler]

@NullVoxPopuli Not exactly, while decrypting you are doing

  const box = NaCl.box(message, nonce, theirPublicKeyUint8Array, mySecretKeyUint8Array);
  const decrypted = NaCl.box.open(box, nonce, theirPublicKeyUint8Array, mySecretKeyUint8Array);

which @dchest hinted me isn’t good since you encrypt the message again

  const decrypted = secretbox.open(message, nonce, keyUint8Array);

Please note my code is about secretbox, not box, but I think its still analogue.