bugtraq - Re: base64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 23 Sep 2003 21:38:08 +0400
From: "Ilya Teterin"  <alienhard@...l.ru>
To: bugtraq@...urityfocus.com
Subject: Re: base64

Erwan David:
> I'll add 5. consider data encoding as broken and return an error.
> The base64 specification specifies how to encode. If you get
> padding character inside data, it's no more base64 encoded data.

The base64 specification specifies how to decode, too. And it specifies how to handle unexpected characters during decoding. Someone... may assume that specification of decoding is complete :-)

Does anyone know product which actually implements (5)?

Most beautiful product was MS Outlook Express. When it meet padding in the first position, it will decode it as "A". In other positions padding will be decoded as "A" too, but some characters from decoded text will be deleted using "pattern" depending on position of padding. I doubt there is content filtering program which implements the SAME way of base64 decoding.