I am trying to compile to wasm32-unknown-unknown and get the following error:

rust-lld: error: unknown file type: hide.o

I read that I can't compile clear_on_drop to wasm.

So it would be nice it could be excluded optionally.

This is a tracking issue for adding support for the STREAM nonce-based OAE construction as described in the paper Online Authenticated-Encryption and its Nonce-Reuse Misuse-Resistance (Section 7, p. 18):

Design

The STREAM design used in Miscreant has the following properties:

• KDF is not mandatory: raw E_k is used for encryption
• Nonce encoding is nonce_prefix || ctr || last_block where:
  • nonce_prefix: 8-byte (64-bit) fixed prefix
  • ctr: 32-bit big endian counter value
  • last_block: 1-byte flag indicating if this is the last block (0x00 if false, 0x01 if true)
• Associated data is per-message (as suggested in the IACR version of the paper)

Implementation Status

This is a tracking issue for adding STREAM support to the various language-specific implementations in this project:

| Language | Support | Notes | |--------------|---------|-------------| | Go | ✅ | Done (#132) | | Python | ✅ | Done (#124) | | Ruby | ✅ | Done (#122) | | Rust | ✅ | Done (#112) | | TypeScript | ✅ | Done (#131) |

This is the C# version of AES-SIV, targeting .NET Standard 2.0. That means it's cross-platform, working on both .NET Framework and .NET Core. This version contains AES-SIV implementation that is using CMAC (I plan to add PMAC very soon). It can currently be built from scratch, but I plan to build the Nuget package for it. The full test suite is present, but I didn't write the CI script yet (I never used Travis with .NET, so I have to learn how to do that first).

This PR is mostly to see if it passes through your CI. And maybe there is some bikeshedding to be done on the name of the flag :sweat_smile:

Other than that, is there anything this is missing? (Assuming it passes the tests)

When trying to test interoperability with an implementation for another lib, I stumbled on the case where N=0 (according to https://tools.ietf.org/html/rfc5297#section-2.4 ). That's the case where the key is used to encrypt zero data, zero AD, with no nonce. That follows a separate path in the pseudo code:

      S2V(K, S1, ..., Sn) {
        if n = 0 then
          return V = AES-CMAC(K, <one>)
        fi

On your test vectors I see the following:

            "name:s":"Empty Authenticated Data And Plaintext Example",
            "key:d16":"fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
            "ad:A<d16>":[],
            "plaintext:d16":"",
"ciphertext:d16":"f2007a5beb2b8900c588a7adf599f172"

With my implementation

key: fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff
nonce,aad,plaintext zero
ciphertext: 949f99cbcc3eb5da6d3c45d0f59aa9c7

While I'm not complete sure that this lib is wrong here, when in my code remove the special handling for the case of zero ad,plaintext and nonce, it brings the exact same ciphertext as you have in the test vector. Seeing the code, there seems to be no special handling of this case.

Hello, I think I found a bug. Please have a look at the following C# code:

var aead = Aead.CreateAesCmacSiv( masterKey ); aead.Seal( Encoding.UTF8.GetBytes( "123456789012345" ) ); // Works aead.Seal( Encoding.UTF8.GetBytes( "1234567890123456" ) ); // Crashes aead.Seal( Encoding.UTF8.GetBytes( "12345678901234567" ) ); // Works

Message: "Index out of range" StackTrace: "Miscreant.Utils.Pad(Byte[] buffer, Int32 position)\r\n bei Miscreant.AesSiv.S2V(Byte[][] headers, Byte[] message)\r\n bei Miscreant.AesSiv.Seal(Byte[] plaintext, Byte[][] data)"

An aead.Open() will crash, too (e.g. when the seal with 16 chars is done with another implementation). NuGet shows me a Miscreant version 0.3.1.

Just seeking your advice.

In your documentation you say to use a unique nonce for every encrypted message when using AES-SIV.

Is this a requirement? If not, what would be the security issues? If yes, then can the nonce be appended to the first 16 bytes of the encrypted output?

The reason I ask is that I see some production projects that are using the same KEY + NONCE for every encryption.

See here: https://cryptomator.org/security/architecture/ Look for: Filename Encryption

Hi,

this pull request was created with help of Feram! It's a tool which automatically finds and fixes bugs in your repos.

To view the other patches we created for your code simply activate Feram on github.com/apps/feram. Or if you are new to GitHub apps, check out the full tutorial at feram.io/help/getting-started.

If you have any feedback or wishes, don't hesitate to contact me or open an issue at github.com/feramhq/feram!

Hope you like it! 😁

Hey,

When trying to install miscrants dev-dependencies today, the node-webcrypto-ossl install failed with an error in build:e5 tsc.

just running the following:

$ npm install

...SNIP...

> [email protected] postinstall /Users/aegarbutt/src/miscreant/js/node_modules/node-webcrypto-ossl
> npm run build


> [email protected] build /Users/aegarbutt/src/miscreant/js/node_modules/node-webcrypto-ossl
> npm run build:es5


> [email protected] build:es5 /Users/aegarbutt/src/miscreant/js/node_modules/node-webcrypto-ossl
> tsc

lib/crypto/aes.ts(94,13): error TS2322: Type 'Promise<{}>' is not assignable to type 'PromiseLike<ArrayBuffer>'.
  Types of property 'then' are incompatible.
    Type '<TResult1 = {}, TResult2 = never>(onfulfilled?: ((value: {}) => TResult1 | PromiseLike<TResult1>)...' is not assignable to type '<TResult1 = ArrayBuffer, TResult2 = never>(onfulfilled?: ((value: ArrayBuffer) => TResult1 | Prom...'.
      Types of parameters 'onfulfilled' and 'onfulfilled' are incompatible.
        Types of parameters 'value' and 'value' are incompatible.
          Type '{}' is not assignable to type 'ArrayBuffer'.
            Property 'byteLength' is missing in type '{}'.
lib/crypto/aes.ts(102,13): error TS2322: Type 'Promise<{}>' is not assignable to type 'PromiseLike<ArrayBuffer>'.
lib/crypto/hmac.ts(26,29): error TS2345: Argument of type 'CryptoKey' is not assignable to parameter of type 'CryptoKeyPair | PromiseLike<CryptoKeyPair> | undefined'.
  Type 'CryptoKey' is not assignable to type 'PromiseLike<CryptoKeyPair>'.
    Property 'then' is missing in type 'CryptoKey'.
lib/crypto/pbkdf2.ts(44,9): error TS2322: Type 'Promise<CryptoKey>' is not assignable to type 'PromiseLike<CryptoKey>'.
  Types of property 'then' are incompatible.
    Type '<TResult1 = CryptoKey, TResult2 = never>(onfulfilled?: ((value: CryptoKey) => TResult1 | PromiseL...' is not assignable to type '<TResult1 = CryptoKey, TResult2 = never>(onfulfilled?: ((value: CryptoKey) => TResult1 | PromiseL...'. Two different types with this name exist, but they are unrelated.
      Types of parameters 'onfulfilled' and 'onfulfilled' are incompatible.
        Types of parameters 'value' and 'value' are incompatible.
          Type 'CryptoKey' is not assignable to type 'CryptoKey'. Two different types with this name exist, but they are unrelated.
            Property 'native_' is missing in type 'CryptoKey'.

However, if I drop the typescript version to @2.3.4 (as found in this issue: https://github.com/PeculiarVentures/node-webcrypto-ossl/issues/107)

$ npm install

...SNIP...

z
> [email protected] postinstall /Users/aegarbutt/src/miscreant/js/node_modules/node-webcrypto-ossl
> npm run build


> [email protected] build /Users/aegarbutt/src/miscreant/js/node_modules/node-webcrypto-ossl
> npm run build:es5


> [email protected] build:es5 /Users/aegarbutt/src/miscreant/js/node_modules/node-webcrypto-ossl
> tsc

added 487 packages in 53.381s

Thanks!

This commit attempts to simplify the licensing information by consolidating authors in AUTHORS.md and unifying the LICENSE.txt files where applicable.

• The Miscreant::AES::SIV namespace is now Miscreant::Internals::SIV.
• The message given to seal must be binary encoded.
• The nonce given to seal and open must be an array.

My understanding from the paper is that STREAM's security notion (nOAE) requires that nonces don't repeat. Instantiating STREAM on top of AES-SIV does make nonce reuse slightly less harmful, I think.* But an attacker can do something like chunk swapping between two messages that share the same nonce, which means that authenticity is immediately lost after a single reuse. Do I have that right? Is that something worth clarifying in the docs?

* It seems like some privacy might be retained after a few nonce reuses, but the "chosen prefix, secret suffix" attack described in the same paper would work if the attacker could make a lot of queries.

Hi.

I get different results with the same DotNet-Code (miscreant.net) in Windows and Xamarin on Android.

I use this project "CryptomatorAccessDemo" (or more specific only the "CryptomatorHelper") that is using miscreant.net to (de)code Cryptomator Vaults.

To test I simply use and test vault with just some small files and folders in it.

My detailed problem description with example logs and code links where it is implemented is here: https://github.com/lellis1936/CryptomatorAccessDemo/issues/1

Currently as a workaround I use a "Binding Library" for the original Cryptomator "siv-mode" java jar file but of course it would be nice to have all in csharp.

I think it is somewhere when using "TransformFinalBlock", I found a DotNet Bug about verison below 4.6.2 for reuse, but even when I used higher versions for the windows example tool (CryptomatorAccessDemo), it was still working for me, I could not recreate the problem (the other/wrong hash) with windows.

Any idea what it could be or what I could try?

Many thanks!

In the following wiki document: https://github.com/miscreant/miscreant/wiki/Python-Documentation

The last piece of example code should be like this:

import os
from miscreant.aes.siv import SIV

key = SIV.generate_key()
siv = SIV(key)

message = "Hello, world!"
nonce = os.urandom(16)

ciphertext = siv.seal(message, [nonce])
plaintext = siv.open(ciphertext, [nonce])

(only the last line is different as we should open ciphertext and not message)

According to Seal/Open documentations (and the cipher.AEAD interface), they should work when dst and plaintext (resp. ciphertext) overlap entirely.

However, that doesn't work. This test fails:

func TestAESCMACSIVInPlace(t *testing.T) {
	v := loadAESSIVExamples("aes_siv.tjson")[0]

	c, err := NewAESCMACSIV(v.key)
	if err != nil {
		t.Fatalf("NewAESCMACSIV: %s", err)
	}
	pt := make([]byte, len(v.plaintext), len(v.plaintext)+c.Overhead())
	copy(pt, v.plaintext)
	ct, err := c.Seal(pt[:0], pt, v.ad...)
	if err != nil {
		t.Errorf("Seal: %s", err)
	}
	if !bytes.Equal(v.ciphertext, ct) {
		t.Errorf("Seal: expected: %x\ngot: %x", v.ciphertext, ct)
	}

	copy(ct, v.ciphertext)
	pt, err = c.Open(ct[:0], ct, v.ad...)
	if err != nil {
		t.Errorf("Open: %s", err)
	}
	if !bytes.Equal(v.plaintext, pt) {
		t.Errorf("Open: expected: %x\ngot: %x", v.plaintext, pt)
	}
}

I can write a MR fixing this, however, since the tag comes before the ciphertext it seems that will require making a whole copy of the input in this case (since XORKeyStream alse requires its input to overlap entirely or not at all), entirely defeating the purpose of the in-place optimization. However, I don't see a way out without breaking the cipher.AEAD contract, or moving the tag after the ciphertext (#152)

What do you think?

Using AES-PMAC-SIV with Python 3.6 as follows produces as an error:

from miscreant.aead import AEAD
from secrets import token_bytes

aead = AEAD('AES-PMAC-SIV', key=b'0'*64)

# this works:
aead.seal(token_bytes(1024*4), nonce=b'0' * 16)

# this fails:
aead.seal(token_bytes(1024*5), nonce=b'0' * 16)

Traceback (most recent call last):
  File "error.py", line 5, in <module>
    aead.seal(token_bytes(1024*5), nonce=b'0' * 16)
  File "/Users/denis/.virtualenvs/spare/lib/python3.6/site-packages/miscreant/aead.py", line 60, in seal
    return self.siv.seal(plaintext, [associated_data, nonce])
  File "/Users/denis/.virtualenvs/spare/lib/python3.6/site-packages/miscreant/aes/siv.py", line 47, in seal
    v = self.__s2v(associated_data, plaintext)
  File "/Users/denis/.virtualenvs/spare/lib/python3.6/site-packages/miscreant/aes/siv.py", line 114, in __s2v
    mac.update(plaintext[:difference])
  File "/Users/denis/.virtualenvs/spare/lib/python3.6/site-packages/miscreant/mac/pmac.py", line 118, in update
    self.__process_buffer()
  File "/Users/denis/.virtualenvs/spare/lib/python3.6/site-packages/miscreant/mac/pmac.py", line 145, in __process_buffer
    self.offset.xor_in_place(self.l[ctz.trailing_zeroes(self.counter + 1)])
  File "/Users/denis/.virtualenvs/spare/lib/python3.6/site-packages/miscreant/ctz.py", line 25, in trailing_zeroes
    return CTZ_TABLE[value]
IndexError: list index out of range

With AES-SIV this error does not occur.

I am using the following, but can't seem to get it working in Node 9. Any help would be appreciated.

Error: AES-SIV: ciphertext verification failure!

let generateDataKey = () => {
    return new Promise((resolve, reject) => {
        crypto.randomBytes(32, (err, buf) => {
            if (err) throw err;
            resolve(buf);
        });
    });
};

let generateNonce = () => {
    return new Promise((resolve, reject) => {
        crypto.randomBytes(16, (err, buf) => {
            if(err) throw err;
            resolve(buf);
        });
    });
};

async function encryptText(plainText) {
    // get new datakey
    const dataKey = await generateDataKey();
    //get nonce
    const nonce = await generateNonce();
    
    // get encryptor
    let encryptor = await miscreant.SIV.importKey(dataKey, "AES-SIV", new miscreant.PolyfillCryptoProvider());
    let stringBuffer = Buffer.from(plainText, 'utf8');
    let cipherText = await encryptor.seal(stringBuffer, dataKey, nonce);
    let decrypted = await encryptor.open(cipherText, nonce)
}