Re: Cryptlib OpenPGP enveloping occasionally produces unreadable data

Dr. Gutmann commented offline. I think the list might benefit from it:

>> At least the internet did not collapse with this one ;)
>>
> No, in fact the odd thing is that tools like pgpdump process the message OK
> since they look at lengths of internal data rather than the overall packet
> length.  So if you try and validate the output using pgpdump then it checks
> out, it's only cryptlib's more pedantic checks that reject it, and since you
> have to run the test a thousand or more times, the self-check didn't catch it.

Jeff

On Mon, Jun 23, 2014 at 6:49 AM, Jeffrey Walton <[email protected]> wrote:
>>>I notice that when we perform openpgp enveloping, cryptlib occasionally
>>>produces data that cannot be de-enveloped by itself. I've attached the code
>>>for a test I wrote for this. When I run it, cryptlib gives
>>>CRYPT_ERROR_BADDATA about 5-10 times out of a 1000.
>
>> The problem occurs because some of the lower-level code used by cryptlib
>> performs leading-zero truncation and some doesn't (specifically, PKCS #11
>> drivers are erratic as to whether they do it or not, see the code comment in
>> device/pkcs11_pkc.c).  cryptlib tries to compensate for the differences, but
>> in this case it over-compensated (the fact that about one in 256 operations
>> failed was the giveaway because 1/256 results will have a leading zero, what
>> puzzled me was that I knew I'd addressed this issue, but it was being
>> cancelled out in a second location that only occurred with PGP data).  Anyway,
>> the fix is, in mechs/mech_pkwrap.c, line 297, to change the code block to:
>
> At least the internet did not collapse with this one ;)

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.