Show page

Differences

This shows you the differences between two versions of the page.

--- sasc:laboratoare:09 [2016/05/02 13:13]
sergiu.costea [Exercise 3]
+++ sasc:laboratoare:09 [2017/05/02 11:00] (current)
dan.dragan
@@ Line 1: / Line 1: @@
-===== Lab 09 - OpenSSL MACs and Hashing =====
+===== Lab 09 - OpenSSL AEAD =====
+Before you start solving the exercises below, download the {{:ic:laboratoare:ic_lab10.zip|lab archive from here}}.
 ==== Exercise 1 ====
+The archive contains the source code for Exercise 2, but sadly it is encrypted. Luckily, we forgot to remove the password file from the archive.
+Use ''openssl'' commands to decrypt the source file.
+<note hint>
+The file is encrypted using AES-256 in CBC mode.
+</note>
 ==== Exercise 2 ====
+In this exercise we'll use OpenSSL to encrypt and decrypt with AES-128-GCM. Unfortunately, AES-GCM is not supported by the command line utilities of OpenSSL so we'll have to implement it ourselves.
-==== Exercise 3 ====
+Open the file you decrypted in the previous exercise and inspect the code. There are two functions that need to be implemented: ''aes_gcm_encrypt'' and ''aes_gcm_decrypt''. We have included hints to guide you through the code.
-In this exercise you will implement the Birthday attack on SHA-1 from the previous lab using OpenSSL. The goal is to obtain a collision in the first four bytes of the hash.
+The main program initializes a dummy key and a dummy IV; a long message is then encrypted and decrypted. The encryption should automatically include the authentication tag at the end, and the decryption should return an error if the verification of the tag fails.
-You can implement the attack from scratch, or start from our archive here.
+If you do not change keys and the implementation is ok, the ciphertext you obtain should be equal to our own. Otherwise, some of the tests will fail.
-To compute a digest, you might find the code below useful:
+Below we have included an example of encryption with RC2 (taken from the OpenSSL man pages). The AES-GCM encryption implementation is quite similar - the authentication tag is automatically appended when finalizing the encryption context.
 <code C>
-    SHA_CTX context;
+int do_crypt(FILE *in, FILE *out, int do_encrypt) {
-    SHA1_Init(&context);
+    /* Allow enough space in output buffer for additional block */
-    SHA1_Update(&context, buffer, length);
+    inbuf[1024], outbuf[1024 + EVP_MAX_BLOCK_LENGTH];
-    SHA1_Final(md, &context); /* md must point to at least 20 bytes of valid memory */
+    int inlen, outlen;
+    /* Bogus key and IV: we'd normally set these from
+     * another source.
+     */
+    unsigned char key[] = "0123456789";
+    unsigned char iv[] = "12345678";
+    /* Don't set key or IV because we will modify the parameters */
+    EVP_CIPHER_CTX_init(&ctx);
+    EVP_CipherInit_ex(&ctx, EVP_rc2(), NULL, NULL, NULL, do_encrypt);
+    EVP_CIPHER_CTX_set_key_length(&ctx, 10);
+    /* We finished modifying parameters so now we can set key and IV */
+    EVP_CipherInit_ex(&ctx, NULL, NULL, key, iv, do_encrypt);
+    for(;;) {
+        inlen = fread(inbuf, 1, 1024, in);
+        if(inlen <= 0) break;
+        if(!EVP_CipherUpdate(&ctx, outbuf, &outlen, inbuf, inlen)) {
+            /* Error */
+            EVP_CIPHER_CTX_cleanup(&ctx);
+            return 0;
+        }
+        fwrite(outbuf, 1, outlen, out);
+    }
+    if(!EVP_CipherFinal_ex(&ctx, outbuf, &outlen)) {
+        /* Error */
+        EVP_CIPHER_CTX_cleanup(&ctx);
+        return 0;
+    }
+    fwrite(outbuf, 1, outlen, out);
+    EVP_CIPHER_CTX_cleanup(&ctx);
+    return 1;
+}
 </code>
+<note hint>
+You may need to change the the LDFLAGS in Makefile:
+LDFLAGS=-lcrypto -ldl
+</note>
+<note tip>
+See the open ssl manual [[https://www.openssl.org/docs/man1.1.0/crypto/EVP_aes_256_gcm.html|here]] page for EVP encrypt to see the usage of the EVP functions and an example similar to the one above.
+</note>