[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 19 Sep 2016 12:53:51 -0700
From: Seth Arnold <seth.arnold@...onical.com>
To: Mike Santillana <michael.santillana@...ork.com>
Cc: oss-security@...ts.openwall.com, 'Apple' via <infosec@...ork.com>
Subject: Re: CVE Request - Ruby OpenSSL Library - IV Reuse in
GCM Mode
On Mon, Sep 19, 2016 at 03:20:02PM -0400, Mike Santillana wrote:
> An IV reuse bug was discovered in Ruby's OpenSSL library when using
> aes-gcm. When encrypting data with aes-*-gcm, if the IV is set before
> setting the key, the cipher will default to using a static IV. This creates
> a static nonce and since aes-gcm is a stream cipher, this can lead to known
> cryptographic issues.
>
> The documentation does not appear to specify the order of operations when
> setting the key and IV [1]. As an example, see the following insecure code
> snippet below:
>
> Vulnerable Code:
>
> def encrypt(plaintext)
> cipher = OpenSSL::Cipher.new('aes-256-gcm')
> iv = cipher.random_iv # Notice here the IV is set before the key
> cipher.key = '11111111111111111111111111111111'
> cipher.auth_data = ""
> ciphertext = cipher.update(plaintext) + cipher.final
> tag = cipher.auth_tag
>
> puts "[+] Encrypting: #{plaintext}"
> puts "[+] CipherMessage (IV | Tag | Ciphertext): #{bin2hex(iv)} |
> #{bin2hex(tag)} | #{bin2hex(ciphertext)}"
> end
Hello,
I think you have a mistake in this sample code, 'iv' is assigned but never
used (aside from being printed).
Your github code is far more complicated but looks like it is doing the
right thing.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
