[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <9C0DC1F6-0473-4888-A051-6CFC8872E94D@gmail.com>
Date: Mon, 19 Sep 2016 15:03:23 -0500
From: Brandon Perry <bperry.volatile@...il.com>
To: oss-security@...ts.openwall.com
Cc: Mike Santillana <michael.santillana@...ork.com>,
'Apple' via <infosec@...ork.com>
Subject: Re: CVE Request - Ruby OpenSSL Library - IV Reuse in GCM Mode
> On Sep 19, 2016, at 2:53 PM, Seth Arnold <seth.arnold@...onical.com> wrote:
>
> On Mon, Sep 19, 2016 at 03:20:02PM -0400, Mike Santillana wrote:
>> An IV reuse bug was discovered in Ruby's OpenSSL library when using
>> aes-gcm. When encrypting data with aes-*-gcm, if the IV is set before
>> setting the key, the cipher will default to using a static IV. This creates
>> a static nonce and since aes-gcm is a stream cipher, this can lead to known
>> cryptographic issues.
>>
>> The documentation does not appear to specify the order of operations when
>> setting the key and IV [1]. As an example, see the following insecure code
>> snippet below:
>>
>> Vulnerable Code:
>>
>> def encrypt(plaintext)
>> cipher = OpenSSL::Cipher.new('aes-256-gcm')
>> iv = cipher.random_iv # Notice here the IV is set before the key
>> cipher.key = '11111111111111111111111111111111'
>> cipher.auth_data = ""
>> ciphertext = cipher.update(plaintext) + cipher.final
>> tag = cipher.auth_tag
>>
>> puts "[+] Encrypting: #{plaintext}"
>> puts "[+] CipherMessage (IV | Tag | Ciphertext): #{bin2hex(iv)} |
>> #{bin2hex(tag)} | #{bin2hex(ciphertext)}"
>> end
>
> Hello,
>
> I think you have a mistake in this sample code, 'iv' is assigned but never
> used (aside from being printed).
Ruby really likes side-effects. Calling #random_iv generates and sets a new IV on the cipher, then returns it to the caller. Very magical.
https://ruby-doc.org/stdlib-2.0.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html#method-i-random_iv <https://ruby-doc.org/stdlib-2.0.0/libdoc/openssl/rdoc/OpenSSL/Cipher.html#method-i-random_iv>
>
> Your github code is far more complicated but looks like it is doing the
> right thing.
>
> Thanks
Content of type "text/html" skipped
Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
