Decide whether to zeroize buffer or encrypt it back on tag check failure

Open
#660 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
30/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
rust
Domain
cryptography, security

Research direction

Compare the zeroization approach used by ascon-aead in issue #659 with the encrypt-back approach used by aes-gcm in issue #551. Survey how libraries outside the Rust ecosystem handle one-pass decryption after tag-check failure; done requires a decided strategy and agreement on the resulting buffer behavior.

Written by the indexing model from the issue text.

Description

With one-pass decryption we start to decrypt ciphertext before its integrity was verified. In the case if tag check has failed in the end we need to erase decrypted data. It can be done either by zeroizing the input buffer (as done in ascon-aead, see #659) or by encrypting it back (as done in aes-gcm, see #551).

We probably should look into what is done in other libraries outside of the Rust ecosystem.

Dominant language
Rust
Stars
961
Forks
200
Avg merge
1h 30m
Merged PRs (30d)
6

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from RustCrypto/AEADs

All issues in RustCrypto/AEADs

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.