AES-CBC-HMAC: AL covers the protected header only, so the tag of a JWE with an "aad" member does not follow RFC 7518

オープン
  • 何か問題がありますか？
#759 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
58/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
php
領域
cryptography, security

調査の方向性

Find AESCBCHS::calculateAuthenticationTag() and trace how it builds A and computes AL for JSON serialization with an aad member. Add the external known-answer test and cross-implementation vectors described in the issue. Done means AL covers the whole A, the tags interoperate with another JOSE implementation, and the regression tests pass; check the compatibility impact for existing tokens and the proposed upgrade note.

索引モデルが issue の本文から書いたものです。

説明

bug
Version(s) affected

All released versions (3.4.x, 4.0.x, 4.1.x, 4.2.x), and the 4.3.x and 5.0.x branches. The computation dates from the initial import.

Description

AESCBCHS::calculateAuthenticationTag() builds the additional authenticated data A as BASE64URL(protected) || '.' || BASE64URL(aad) when the JWE has an aad member, but computes AL, the 64-bit length appended to the HMAC input, from the protected header alone. AL must be the length of the whole A, in bits.

This only concerns A128CBC-HS256, A192CBC-HS384 and A256CBC-HS512 JWEs that carry an aad member, which exists in the JSON serializations only. Compact tokens, tokens without aad, and AES-GCM are not affected.

Consequences:

  • Interoperability: the tag differs from the one conforming implementations compute. Tokens issued by this library are rejected by them (checked with panva/jose 6.2.2), and theirs are rejected by this library.
  • The tag does not commit to the length of the AAD, so the boundary between the AAD and the IV is not authenticated. A token whose aad is a strict prefix of the original one, or that has no aad at all, can be made to verify. The AAD content itself cannot be changed, and each such change prepends an unpredictable block to the decrypted payload, so JSON claims and nested tokens no longer parse.
How to reproduce

Encrypt a payload with A128KW and A128CBC-HS256 and an aad, serialize it with the JSON flattened serializer, and decrypt it with another JOSE implementation: the authentication tag is rejected. The other way round fails the same way. Without aad, both directions work.

Possible Solution

Compute AL over the whole A, and add a known-answer test whose expected tag is computed outside the library, plus vectors produced by another implementation.

CBC-HMAC tokens with aad issued by earlier versions stop decrypting after the change, and tokens from other implementations start decrypting. A fallback to the old computation would keep the weakness, so there should be none. Proposed for 4.3.0 with an upgrade note.

Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-SO6XMWCE).

主要言語
PHP
スター
954
フォーク
119
平均マージ
48分
マージ済み PR（30日）
17

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

web-token/jwt-framework のほかの issue

web-token/jwt-framework の issue をすべて見る

似ている issue

PHP の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。