netdev - Re: CCM/GCM implementation defect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 23 Apr 2015 18:01:52 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Martin Willi <martin@...ongswan.org>
Cc:	Horia Geantă <horia.geanta@...escale.com>,
	Steffen Klassert <steffen.klassert@...unet.com>,
	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Paul Wouters <pwouters@...hat.com>,
	Linux Crypto Mailing List <linux-crypto@...r.kernel.org>
Subject: Re: CCM/GCM implementation defect

On Thu, Apr 23, 2015 at 11:58:52AM +0200, Martin Willi wrote:
>
> I'm not sure about that. RFC4106 refers to [1] for test vectors, which
> is still available at web.archive.org [2].
> 
> When looking for example at Test Case 3, this is the same as in a newer
> revision of the document [3]. That looks exactly the same as
> aes_gcm_enc_tv_template[2] from testmgr.h.

These are GCM test vectors, not RFC4106 test vectors so they are
of no use when you're testing whether the IPsec IV (which is not
the same thing as the GCM IV) is included in the authentication
or not.

AFAIK GCM itself is implemented correctly.  It's only the IPsec
wrapper around it (rfc4106 in particular) that's broken.

Cheers,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html