Authenticated Encryption should check for tag length
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 5/5
- 預估耗時
- 一週以上
- 新手友好度
- 30/100
- Issue 類型
- 功能
- 描述清晰度
- 基本清楚
- 活躍度
- 停滯
- 領域
- cryptography, security
研究方向
首先追蹤 AES-GCM 既有的 Cipher#auth_tag 和 #final 行為，包括目前如何引發 CipherError。檢視所要求的 auth_tag_len 行為與文件需求，然後比較加密與解密路徑。當 API 提案獲得解決、標籤長度依指定方式進行檢查，且相關行為已記錄於文件中並有測試涵蓋時，即表示完成。
由索引模型根據 Issue 內容生成。
描述
The current API for using ciphers with Authenticated Encryption (currently only AES-GCM) is rather misleading and quickly leads to subtle bugs related to the length of auth_tag.
In particular, the current implementation will not check for the length of the auth_tag. Because GCM mode allows arbitrary sizes of the auth_tag up to 128 bytes, only a single byte needs to be supplied to make the authentication pass. This means that an attacker needs at most 256 attempts in order to forge a valid auth_tag.
data = 'secret'
cipher = OpenSSL::Cipher.new('aes-128-gcm')
cipher.encrypt
key = cipher.random_key
iv = cipher.random_iv
cipher.auth_data = 'auth_data'
ciphertext = cipher.update(data) + cipher.final
auth_tag = cipher.auth_tag
auth_tag = auth_tag[0] # single byte is sufficient
cipher = OpenSSL::Cipher.new('aes-128-gcm')
cipher.decrypt
cipher.key = key
cipher.iv = iv
cipher.auth_tag = auth_tag
cipher.auth_data = 'auth_data'
data = cipher.update(ciphertext) + cipher.final
# NO error raised
Currently, the only way to prevent such attacks is to manually assert the correct auth_tag length when decrypting/authenticating.
raise 'incorrect auth_tag length' unless auth_tag.length == 16
I suggest the following improvements:
Documentation should mention the importance of manually checking auth_tag length
This can/should be done immediately even if the API should not change.
Authentication tag length should be an input parameter to the cipher
To improve the usability of the API and unburden users from performing additional manual checks without compromising security, I suggest to add an auth_tag_len accessor. This can be used to determine the size of the auth_tag both when generating and when authenticating the auth_tag. The default value should be 16 bytes (see below).
#auth_tag should use auth_tag_len to determine the output length
During encryption:
If no parameter is given, #auth_tag should return an authentication tag according to the length configured in auth_tag_len.
If a length parameter is given, #auth_tag should use the supplied parameter to determine the length of the authentication tag. Although this parameter is not as useful any more it should be kept for backwards compatibility. Maybe it should be deprecated.
Currently the API supports different tag lengths by passing the length parameter to #auth_tag. This currently defaults to 16 bytes, which should be the default value for auth_tag_len in order to keep backwards compatibility.
#final should use auth_tag_len to assert the correct length of the auth_tag
During decryption:
auth_tag_len should be used to assert that the supplied auth_tag has the correct length. The big difference to the existing API lies here, because users need to actively change the value of auth_tag_len in order to allow shorter tags.
When the check fails, an OpenSSL::Cipher::CipherError should be raised. The same type of error is already raised when authentication fails, so existing users should be fine without having to touch their error handling. A descriptive error message should be helpful. In order to distinguish between such errors and "actual" verification errors, we could also add a descriptive message for the latter.
I'd be happy to implement these changes, but I wanted to discuss them first.
For reference: This issue was copied over from the Ruby Issue Tracker https://bugs.ruby-lang.org/issues/12582
- 主要語言
- C
- 星號
- 276
- 分支
- 203
- 平均合併
- 1 天 5 小時
- 30 天內合併 PR
- 10
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
ruby/openssl 的其他 Issue
-
Add OpenSSL::SSL::SSLContext#client_hello_cb= (binding for SSL_CTX_set_client_hello_cb())可能已有人在做 @kou 於 4 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 53/100
維護者通常 1 天內回覆
-
難度 3/5 1-2 天 新手友好度 55/100
維護者通常 1 天內回覆
-
Expose XOFs like SHAKE128 and SHAKE256可能已有人在做 @rhenium 於 101 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 48/100
維護者通常 1 天內回覆
-
難度 5/5 一週以上 新手友好度 35/100
維護者通常 1 天內回覆
-
Unchecked *_set_* calls可能已有人在做 @ndossche 於 171 天前認領。 未關閉
難度 4/5 3-5 天 新手友好度 35/100
維護者通常 1 天內回覆
相似的 Issue
-
native-cpu: -Wreturn-type in skainet_row_threads.c:150 (worker fn has no return)可能已有人在做 @Doomguy-BFG9000 今天認領。 未關閉good first issue size:xs skill:native
難度 1/5 1 小時以內 新手友好度 78/100
SKaiNET-developers/SKaiNET#1358 · 1 則留言 ·
維護者通常 1 天內回覆
-
I/O internal correctness medium priority rt_lib
難度 2/5 1-3 小時 新手友好度 79/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 64/100
libsdl-org/SDL#16539 ·
維護者通常 1 天內回覆
-
git-workflow task-4
難度 2/5 1-3 小時 新手友好度 66/100
-
bug
難度 2/5 1-3 小時 新手友好度 82/100
維護者通常 1 天內回覆