Fix XTS-AES in-place operation with partial final block - #841
Open
Harshal5 wants to merge 2 commits into
Open
Conversation
The ciphertext-stealing step wrote the stolen ciphertext bytes to the output before reading the input tail; with input == output this fed the clobbered bytes into the final block encryption. Read the input tail into the scratch block first. Signed-off-by: harshal.patil <harshal.patil@espressif.com>
Run the IEEE P1619/D16 XTS vectors with input == output: vector 1 (block-aligned control) and vectors 15-18 (partial final block, i.e. ciphertext stealing). Vectors 15-18 fail without the previous commit. Signed-off-by: harshal.patil <harshal.patil@espressif.com>
Contributor
Author
|
Might solve Mbed-TLS/mbedtls#4302 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
mbedtls_aes_crypt_xts()produces wrong output for in-place operation (input == output) whenever the data unit length is not a multiple of 16 bytes: the "ciphertext-stealing" step writes the stolen cipher text bytes tooutput[0..leftover)before readinginput[0..leftover), and in-place the two alias. The clobbered bytes are then fed into the final block encryption instead of the remaining input, so both encryption and decryption of the partial-block tail are corrupted. Block-aligned lengths are unaffected.This PR reads the input tail into the scratch block before the stolen bytes are written (one statement moved), and adds in-place regression tests reusing the IEEE P1619/D16 vectors: vector 1 as a block-aligned control and vectors 15–18 for the "ciphertext-stealing" lengths (17–20 bytes). Vectors 15–18 fail without the fix.
PR checklist
Please remove the segment/s on either side of the | symbol as appropriate, and add any relevant link/s to the end of the line.
If the provided content is part of the present PR remove the # symbol.
Notes for the submitter
Please refer to the contributing guidelines, especially the
checklist for PR contributors.
Help make review efficient: