Soft-errors with cryptlib envelopes

Currently when you push data into a cryptlib de-envelope (and specifically
only push in some of the total amount of data) and all is OK, you'll get back
a CRYPT_OK and byte-count of how much data was used.  However, if you push in
the trailer data at the end (for example a signature) and only push in some of
the data, you'll get a CRYPT_ERROR_UNDERFLOW to indicate that more data is
required to continue.  Diagrammatically:

 [ Header ][ Payload ][ Trailer ]
 ---------------X----------Y-----

if you push in data up to point X, you'll get CRYPT_OK and a byte count
indicating that everything up to point X was copied.  If you push in data up
to point Y you'll get a CRYPT_ERROR_UNDERFLOW and a byte count as before.

The reason for this is that the trailer data is regarded as critical
information.  If cryptlib didn't do that then an attacker who wanted to
manipulate the signed data could strip the signature, cryptlib would return
CRYPT_OK as it did for the payload data, and unless the caller checked very
carefully it'd appear that everything was OK.

The downside of this approach is that getting a CRYPT_ERROR_UNDERFLOW for the
trailer data is a bit non-orthogonal.

What do people think?  I can't think of any better way of doing this (that
doesn't open up significant risk), but if anyone has a better idea for
handling this I'd be interested in hearing it.

Peter.

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.