Skip to content

Commit

Permalink
Merge pull request #102 from nasa/101-incorrect-decryption-logic-for-…
Browse files Browse the repository at this point in the history 
…authentication

101 incorrect decryption logic for authentication
  • Loading branch information
@dccutrig
dccutrig authored Apr 13, 2022
2 parents c2e9408 + 812de92 commit 382990d
Show file tree
Hide file tree
Showing 4 changed files with 48 additions and 64 deletions.
59 changes: 28 additions & 31 deletions src/src_cryptography/src_libgcrypt/cryptography_interface_libgcrypt.template.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -766,37 +766,34 @@ static int32_t cryptography_validate_authentication(uint8_t* data_out, size_t le
return status;
}

//This MAC_DEBUG causes a segfault due to gcry_mac_read wonkiness, after gcry_mac_read, gcry_mac_close or gcry_mac_verify fail. (why?tbd!)
//#ifdef MAC_DEBUG
// uint32_t tmac_size = mac_size;
// uint8_t* tmac = malloc(tmac_size);
// gcry_error = gcry_mac_read(tmp_mac_hd,
// tmac, // tag output
// (size_t *)&tmac_size // tag size // TODO - use sa_ptr->abm_len instead of hardcoded mac size?
// );
// if ((gcry_error & GPG_ERR_CODE_MASK) != GPG_ERR_NO_ERROR)
// {
// printf(KRED "ERROR: gcry_mac_read error code %d\n" RESET, gcry_error & GPG_ERR_CODE_MASK);
// status = CRYPTO_LIB_ERR_MAC_RETRIEVAL_ERROR;
// return status;
// }
//
// printf("Mac Size: %d \n", mac_size);
// printf("Calculated Mac Size: %d\n", tmac_size);
//
// printf("Calculated MAC:\n\t");
// for (uint32_t i = 0; i < tmac_size; i ++){
// printf("%02X", *(tmac + i));
// }
// printf("\n");
// free(tmac);
//
// printf("Received MAC:\n\t");
// for (uint32_t i = 0; i < tmac_size; i ++){
// printf("%02X", *(mac + i));
// }
// printf("\n");
//#endif
#ifdef MAC_DEBUG
uint32_t* tmac_size = &mac_size;
uint8_t* tmac = malloc(*tmac_size);
gcry_error = gcry_mac_read(tmp_mac_hd,
tmac, // tag output
(size_t *)tmac_size // tag size
);
if ((gcry_error & GPG_ERR_CODE_MASK) != GPG_ERR_NO_ERROR)
{
printf(KRED "ERROR: gcry_mac_read error code %d\n" RESET, gcry_error & GPG_ERR_CODE_MASK);
status = CRYPTO_LIB_ERR_MAC_RETRIEVAL_ERROR;
return status;
}

printf("Calculated Mac Size: %d\n", *tmac_size);
printf("Calculated MAC (truncated to sa_ptr->stmacf_len):\n\t");
for (uint32_t i = 0; i < mac_size; i ++){
printf("%02X", tmac[i]);
}
printf("\n");
free(tmac);

printf("Received MAC:\n\t");
for (uint32_t i = 0; i < mac_size; i ++){
printf("%02X", mac[i]);
}
printf("\n");
#endif

// Compare computed mac with MAC in frame
gcry_error = gcry_mac_verify(tmp_mac_hd,
Expand Down
14 changes: 5 additions & 9 deletions src/src_main/crypto_tc.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -514,7 +514,6 @@ int32_t Crypto_TC_ApplySecurity(const uint8_t* p_in_frame, const uint16_t in_fra

if (sa_service_type == SA_AUTHENTICATION)
{

status = cryptography_if->cryptography_authenticate(&p_new_enc_frame[index], // ciphertext output
(size_t)tf_payload_len, // length of data
(uint8_t*)(p_in_frame + TC_FRAME_HEADER_SIZE + segment_hdr_len), // plaintext input
Expand Down Expand Up @@ -890,14 +889,8 @@ int32_t Crypto_TC_ProcessSecurity(uint8_t* ingest, int *len_ingest, TC_t* tc_sdl
}else if (sa_service_type != SA_PLAINTEXT && ecs_is_aead_algorithm == CRYPTO_FALSE) // Non aead algorithm
{
// TODO - implement non-AEAD algorithm logic

if(sa_service_type == SA_ENCRYPTION || sa_service_type == SA_AUTHENTICATED_ENCRYPTION)
{
status = cryptography_if->cryptography_decrypt();
}
if(sa_service_type == SA_AUTHENTICATION || sa_service_type == SA_AUTHENTICATED_ENCRYPTION)
{

status = cryptography_if->cryptography_validate_authentication(tc_sdls_processed_frame->tc_pdu, // plaintext output
(size_t)(tc_sdls_processed_frame->tc_pdu_len), // length of data
&(ingest[tc_enc_payload_start_index]), // ciphertext input
Expand All @@ -915,10 +908,13 @@ int32_t Crypto_TC_ProcessSecurity(uint8_t* ingest, int *len_ingest, TC_t* tc_sdl
*sa_ptr->acs //authentication cipher
);
}
if(sa_service_type == SA_ENCRYPTION || sa_service_type == SA_AUTHENTICATED_ENCRYPTION)
{
status = cryptography_if->cryptography_decrypt();
}

} else // sa_service_type == SA_PLAINTEXT
} else if(sa_service_type == SA_PLAINTEXT)
{
// TODO: Plaintext ARSN
memcpy(tc_sdls_processed_frame->tc_pdu, &(ingest[tc_enc_payload_start_index]),
tc_sdls_processed_frame->tc_pdu_len);
}
Expand Down
38 changes: 15 additions & 23 deletions util/src_util/et_dt_validation.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2105,7 +2105,6 @@ UTEST(NIST_ENC_HMAC_VALIDATION, SHA_256_PT_128_TEST_1)
/**
* @brief Unit Test: Test HMAC SHA-512, bitmask of 0s
**/
/* HMAC SHA 512 authentication gcry_mac_read breaks the state of the libgcrypt engine
UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_0)
{
uint8_t *ptr_enc_frame = NULL;
Expand Down Expand Up @@ -2191,12 +2190,11 @@ UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_0)
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
} */
}

/**
* @brief Unit Test: Test HMAC SHA-512, bitmask of 1s
**/
/* HMAC SHA 512 authentication gcry_mac_read breaks the state of the libgcrypt engine
UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_1)
{
uint8_t *ptr_enc_frame = NULL;
Expand Down Expand Up @@ -2281,12 +2279,12 @@ UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_1)
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
} */
}

/**
* @brief Unit Test: Test HMAC SHA-512, key length 64 bytes, bitmask of 0s
**/
/* HMAC SHA 512 authentication gcry_mac_read breaks the state of the libgcrypt engine
/* This test and next test cause some sort of issue
UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_2)
{
uint8_t *ptr_enc_frame = NULL;
Expand Down Expand Up @@ -2373,12 +2371,12 @@ UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_2)
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
} */
}*/

/**
* @brief Unit Test: Test HMAC SHA-512, key length 64 bytes, bitmask of 1s
**/
/* HMAC SHA 512 authentication gcry_mac_read breaks the state of the libgcrypt engine
/*
UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_3)
{
uint8_t *ptr_enc_frame = NULL;
Expand Down Expand Up @@ -2465,7 +2463,7 @@ UTEST(NIST_ENC_HMAC_VALIDATION, SHA_512_PT_128_TEST_3)
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
} */
}*/

/**
* @brief Unit Test: Test HMAC SHA-256, bitmask of 0s
Expand Down Expand Up @@ -2545,14 +2543,15 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_256_PT_128_TEST_0)
ASSERT_EQ(status, CRYPTO_LIB_SUCCESS);

// Note: For comparison, primarily interested in the MAC
Crypto_Shutdown();

for (int i = 0; i < buffer_python_mac_len; i++)
{
printf("[%d] Truth: %02x, Actual: %02x\n", i, buffer_python_mac_b[i], *(tc_sdls_processed_frame->tc_sec_trailer.mac + i));
ASSERT_EQ(*(tc_sdls_processed_frame->tc_sec_trailer.mac + i), buffer_python_mac_b[i]);
}

Crypto_Shutdown();

free(ptr_enc_frame);
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
Expand Down Expand Up @@ -2656,7 +2655,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_256_PT_128_TEST_1)
UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_0)
{
int32_t status = 0;
uint8_t *ptr_enc_frame = NULL;
// Setup & Initialize CryptoLib
Crypto_Config_CryptoLib(SADB_TYPE_INMEMORY, CRYPTOGRAPHY_TYPE_LIBGCRYPT, CRYPTO_TC_CREATE_FECF_TRUE, TC_PROCESS_SDLS_PDUS_TRUE, TC_HAS_PUS_HDR,
TC_IGNORE_SA_STATE_FALSE, TC_IGNORE_ANTI_REPLAY_TRUE, TC_UNIQUE_SA_PER_MAP_ID_FALSE,
Expand Down Expand Up @@ -2736,10 +2734,9 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_0)
ASSERT_EQ(*(tc_sdls_processed_frame->tc_sec_trailer.mac + i), buffer_python_mac_b[i]);
}

free(ptr_enc_frame);
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
// free(buffer_frame_pt_b);
// free(buffer_nist_key_b);
// free(buffer_python_mac_b);
}

/**
Expand All @@ -2748,7 +2745,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_0)
UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_1)
{
int32_t status = 0;
uint8_t *ptr_enc_frame = NULL;
// Setup & Initialize CryptoLib
Crypto_Config_CryptoLib(SADB_TYPE_INMEMORY, CRYPTOGRAPHY_TYPE_LIBGCRYPT, CRYPTO_TC_CREATE_FECF_TRUE, TC_PROCESS_SDLS_PDUS_TRUE, TC_HAS_PUS_HDR,
TC_IGNORE_SA_STATE_FALSE, TC_IGNORE_ANTI_REPLAY_TRUE, TC_UNIQUE_SA_PER_MAP_ID_FALSE,
Expand Down Expand Up @@ -2816,7 +2812,7 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_1)
hex_conversion(buffer_python_mac_h, (char **)&buffer_python_mac_b, &buffer_python_mac_len);

status = Crypto_TC_ProcessSecurity(buffer_frame_pt_b, &buffer_frame_pt_len, tc_sdls_processed_frame);
ASSERT_EQ(status, CRYPTO_LIB_SUCCESS);
ASSERT_EQ(CRYPTO_LIB_SUCCESS, status);

// Note: For comparison, primarily interested in the MAC
Crypto_Shutdown();
Expand All @@ -2827,7 +2823,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_1)
ASSERT_EQ(*(tc_sdls_processed_frame->tc_sec_trailer.mac + i), buffer_python_mac_b[i]);
}

free(ptr_enc_frame);
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
Expand All @@ -2839,7 +2834,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_1)
UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_2)
{
int32_t status = 0;
uint8_t *ptr_enc_frame = NULL;
// Setup & Initialize CryptoLib
Crypto_Config_CryptoLib(SADB_TYPE_INMEMORY, CRYPTOGRAPHY_TYPE_LIBGCRYPT, CRYPTO_TC_CREATE_FECF_TRUE, TC_PROCESS_SDLS_PDUS_TRUE, TC_HAS_PUS_HDR,
TC_IGNORE_SA_STATE_FALSE, TC_IGNORE_ANTI_REPLAY_TRUE, TC_UNIQUE_SA_PER_MAP_ID_FALSE,
Expand Down Expand Up @@ -2920,7 +2914,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_2)
ASSERT_EQ(*(tc_sdls_processed_frame->tc_sec_trailer.mac + i), buffer_python_mac_b[i]);
}

free(ptr_enc_frame);
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
Expand All @@ -2932,7 +2925,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_2)
UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_3)
{
int32_t status = 0;
uint8_t *ptr_enc_frame = NULL;
// Setup & Initialize CryptoLib
Crypto_Config_CryptoLib(SADB_TYPE_INMEMORY, CRYPTOGRAPHY_TYPE_LIBGCRYPT, CRYPTO_TC_CREATE_FECF_TRUE, TC_PROCESS_SDLS_PDUS_TRUE, TC_HAS_PUS_HDR,
TC_IGNORE_SA_STATE_FALSE, TC_IGNORE_ANTI_REPLAY_TRUE, TC_UNIQUE_SA_PER_MAP_ID_FALSE,
Expand Down Expand Up @@ -3013,7 +3005,6 @@ UTEST(NIST_DEC_HMAC_VALIDATION, SHA_512_PT_128_TEST_3)
ASSERT_EQ(*(tc_sdls_processed_frame->tc_sec_trailer.mac + i), buffer_python_mac_b[i]);
}

free(ptr_enc_frame);
free(buffer_frame_pt_b);
free(buffer_nist_key_b);
free(buffer_python_mac_b);
Expand Down Expand Up @@ -3047,10 +3038,11 @@ UTEST(PLAINTEXT, ENCRYPT_DECRYPT)
// Apply, save the generated frame
status = Crypto_TC_ApplySecurity(jpl_frame_pt_b, jpl_frame_pt_len, &ptr_enc_frame, &enc_frame_len);
ASSERT_EQ(status, CRYPTO_LIB_SUCCESS);

// // Process the generated frame
// Process the generated frame
int len = (int)enc_frame_len;
status = Crypto_TC_ProcessSecurity(ptr_enc_frame, &len, tc_sdls_processed_frame);
Crypto_Shutdown();
ASSERT_EQ(status, CRYPTO_LIB_SUCCESS);
}

Expand Down
1 change: 0 additions & 1 deletion util/src_util/ut_crypto.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -346,7 +346,6 @@ UTEST(CRYPTO_C, GET_ACS_ALGO_KEY_LEN)
**/
UTEST(CRYPTO_C, GET_ECS_ALGO)
{
printf("%d\n", __LINE__);
// Convert CRYPTOAES enum to GCRY_CIPHER_AES256
int32_t libgcrypt_algo = -1;
int8_t crypto_algo = CRYPTO_CIPHER_AES256_GCM;
Expand Down

0 comments on commit 382990d

Please sign in to comment.