user_key from Thorium Reader

[edent]

When I download an LCP file using Thorium, I get a license.lcpl file and an encrypted ePub.

The license contains:

"user_key": {
         "algorithm": "http://www.w3.org/2001/04/xmlenc#sha256",
         "text_hint": "Account Username",
         "key_check": "abc123=="
}

If I use

./lcp-decrypt -userKey example book.epub decode.epub

I get error decrypting file: error decoding user key: encoding/hex: invalid byte: U+0078 'x'

If I hex encode the userKey, I get invalid key size.

If I SHA256 encode my username, I get error getting content key: error decrypting key check: invalid padding length 144 (data length is 48)

Any thoughts on what the correct key would be?

[abustany]

The user key is supposed to be a hex encoded payload… so all characters should be numbers between 0-9 or letters between a-f. I’ve never used thorium, so I don’t know what it exports. Maybe try to hook a network inspector to it (assuming it’s an electron app) and see if you find an HTTP request that fetches the user key ?

[abustany]

According to a quick search this is how thorium persists downloaded user keys: https://github.com/edrlab/thorium-reader/blob/develop/src/main/fs/persistCrypto.ts . I’m on my phone, but you can probably use that info to retrieve the key ?