This repository was archived by the owner on Nov 3, 2021. It is now read-only.
This repository was archived by the owner on Nov 3, 2021. It is now read-only.
AES-KW key unwrapping does not check for integrity #175
Open
Description
This Javascript code, when ran in a browser, properly throws an exception when trying to unwrap the modified wrapped key:
"use strict";
const subtle = crypto.subtle;
const AESWrapKeyFormat = "raw";
async function run() {
const msgKey = await subtle.generateKey({ name: "AES-CTR", length: 128 }, true, ["encrypt"]);
const wrapKey = await subtle.generateKey({ name: "AES-KW", length: 128 }, true, ["wrapKey", "unwrapKey"]);
const wrappedKey = await subtle.wrapKey(AESWrapKeyFormat, msgKey, wrapKey, "AES-KW");
var wrappedKeyAr = new Uint8Array(wrappedKey);
// Inject fault
wrappedKeyAr[0] ^= 1;
console.log(wrappedKeyAr);
var unwrappedKey = null;
try {
unwrappedKey = await subtle.unwrapKey("raw", wrappedKey, wrapKey, { name: "AES-KW" }, { name: "AES-CTR", length: 128 }, true, ["decrypt"]);
}
catch (e) {
console.log("Unwrapp error: " + e);
return;
}
console.log("unwrapped succeeds");
var iv = new Uint8Array(16);
crypto.getRandomValues(iv);
var data = new Uint8Array(2);
data[0] = 0x41;
data[1] = 0x41;
const encrData = await subtle.encrypt({ name: "AES-CTR", counter: iv, length: 64 }, msgKey, data);
const decrData = await subtle.decrypt({ name: "AES-CTR", counter: iv, length: 64 }, unwrappedKey, encrData);
const view = new Uint8Array(decrData)
console.log(view[0] == 0x41 && view[1] == 0x41)
}
run();
See https://jsfiddle.net/rnf6kdL9/1/
When the same code runs in Node 14.x using node-webcrypto-ossl v2.1.3, no exception is thrown when trying to unwrap the modified wrapped key. The integrity of the unwrapped key should be checked, as defined here: https://datatracker.ietf.org/doc/html/rfc3394#page-6
Metadata
Metadata
Assignees
Labels
No labels