Re: Re: SonarLint complaining about "Use a stronger padding scheme"
One Sini <[email protected]> Wed, 17 Apr 2024 01:48:29 +0200
| Newsgroups | gmane.comp.encryption.cryptopp |
|---|---|
| Message-ID | <CAJm61-BxHt2h1D3abpygLrW4ayDxsnTdBEjzB4yftfrM9k7eHQ@mail.gmail.com> |
--000000000000a9a4f606163f607b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
the code
#include <iostream>
#include <cryptopp/rsa.h>
#include <cryptopp/filters.h>
#include <cryptopp/osrng.h>
#include <cryptopp/sha.h>
#include <cryptopp/hex.h>
int main() {
// Generate RSA keys with 2048 bits
CryptoPP::AutoSeededRandomPool rng;
CryptoPP::RSA::PrivateKey
privateKey; privateKey.GenerateRandomWithKeySize(rng, 2048);
CryptoPP::RSA::PublicKey publicKey;
publicKey.AssignFrom(privateKey);
// Message
std::string message =3D "secret";
// Encrypt with OAEP padding
CryptoPP::RSAES_OAEP_SHA_Encryptor encryptor(publicKey);
std::string encrypted;
CryptoPP::StringSource(message, true,
new CryptoPP::PK_EncryptorFilter(rng, encryptor,
new CryptoPP::StringSink(encrypted)
)
);
// Decrypt
CryptoPP::RSAES_OAEP_SHA_Decryptor decryptor(privateKey);
std::string decrypted;
CryptoPP::StringSource(encrypted, true,
new CryptoPP::PK_DecryptorFilter(rng, decryptor,
new CryptoPP::StringSink(decrypted)
)
);
// Print results
std::cout << "Original message: " << message << std::endl;
std::cout << "Encrypted message (hex): ";
CryptoPP::StringSource(encrypted, true,
new CryptoPP::HexEncoder(
new CryptoPP::FileSink(std::cout)
)
);
std::cout << std::endl;
std::cout << "Decrypted message: " << decrypted << std::endl;
return 0;
}
Jeffrey Walton <[email protected]> schrieb am Di. 16. Apr. 2024 um 21:19:
>
>
> On Tue, Apr 16, 2024 at 1:44=E2=80=AFPM One Sini <[email protected]> wrot=
e:
>
>> I wasn't entirely satisfied with the security, so I've adjusted the code=
.
>> I'm not sure if that helps you, depending on what you're doing with it.
>>
>> This code uses RSA with OAEP (Optimal Asymmetric Encryption Padding) to
>> avoid security issues like padding oracle attacks. It generates RSA keys
>> with a length of 2048 bits, encrypts the message with OAEP padding, and
>> then decrypts it.
>>
>> Best Regards Satoshi
>>
>
> I deleted the message from the group. The *.pdf and *.pages smells of
> malware.
>
> If you want to provide code, please inline it or provide it as a text
> attachment.
>
> Jeff
>
>> --
> You received this message because you are subscribed to the Google Groups
> "Crypto++ Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/cryptopp-users/CAH8yC8%3DwptAsfC1eM0Up3=
7oZt14dok_C3R%3DqLiwSrbUJHiVNSw%40mail.gmail.com
> <https://groups.google.com/d/msgid/cryptopp-users/CAH8yC8%3DwptAsfC1eM0Up=
37oZt14dok_C3R%3DqLiwSrbUJHiVNSw%40mail.gmail.com?utm_medium=3Demail&utm_so=
urce=3Dfooter>
> .
>
--=20
You received this message because you are subscribed to the Google Groups "=
Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/=
cryptopp-users/CAJm61-BxHt2h1D3abpygLrW4ayDxsnTdBEjzB4yftfrM9k7eHQ%40mail.g=
mail.com.
--000000000000a9a4f606163f607b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"auto">the code=C2=A0</div><div dir=3D"auto"><br></div><div>#inc=
lude <iostream>=C2=A0</div><div dir=3D"auto">#include <cryptopp/rs=
a.h>=C2=A0</div><div dir=3D"auto">#include <cryptopp/filters.h>=C2=
=A0</div><div dir=3D"auto">#include <cryptopp/osrng.h>=C2=A0</div><di=
v dir=3D"auto">#include <cryptopp/sha.h>=C2=A0</div><div dir=3D"auto"=
>#include <cryptopp/hex.h>=C2=A0</div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">int main() {<br></div><div dir=3D"auto">=C2=A0 =C2=A0 // Gen=
erate RSA keys with 2048 bits=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 Cr=
yptoPP::AutoSeededRandomPool rng;=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=
=A0 CryptoPP::RSA::PrivateKey =C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 p=
rivateKey; privateKey.GenerateRandomWithKeySize(rng, 2048);=C2=A0</div><div=
dir=3D"auto"><br></div><div dir=3D"auto">=C2=A0 =C2=A0 CryptoPP::RSA::Publ=
icKey publicKey;=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 publicKey.Assig=
nFrom(privateKey);=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto"=
>=C2=A0 =C2=A0 // Message=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 std::s=
tring message =3D "secret";=C2=A0</div><div dir=3D"auto"><br></di=
v><div dir=3D"auto">=C2=A0 =C2=A0// Encrypt with OAEP padding=C2=A0</div><d=
iv dir=3D"auto">=C2=A0 =C2=A0CryptoPP::RSAES_OAEP_SHA_Encryptor encryptor(p=
ublicKey);=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0std::string encrypted;=
=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">=C2=A0 =C2=A0Cryp=
toPP::StringSource(message, true,=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=
=A0 =C2=A0 =C2=A0new CryptoPP::PK_EncryptorFilter(rng, encryptor,=C2=A0</di=
v><div dir=3D"auto">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 new CryptoPP:=
:StringSink(encrypted)=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 =C2=A0 =
=C2=A0)</div><div dir=3D"auto">=C2=A0);=C2=A0</div><div dir=3D"auto"><br></=
div><div dir=3D"auto">=C2=A0 =C2=A0 // Decrypt=C2=A0</div><div dir=3D"auto"=
>=C2=A0 =C2=A0 CryptoPP::RSAES_OAEP_SHA_Decryptor decryptor(privateKey);=C2=
=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 std::string decrypted;=C2=A0</div>=
<div dir=3D"auto"><br></div><div dir=3D"auto">=C2=A0 =C2=A0 CryptoPP::Strin=
gSource(encrypted, true,=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 =C2=A0 =
=C2=A0 new CryptoPP::PK_DecryptorFilter(rng, decryptor,=C2=A0</div><div dir=
=3D"auto">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0new CryptoPP::Str=
ingSink(decrypted)</div><div dir=3D"auto">=C2=A0 =C2=A0 =C2=A0 =C2=A0 )=C2=
=A0</div><div dir=3D"auto">=C2=A0);</div><div dir=3D"auto"><br></div><div d=
ir=3D"auto">=C2=A0 =C2=A0 // Print results=C2=A0</div><div dir=3D"auto">=C2=
=A0 =C2=A0 std::cout << "Original message: " << messa=
ge << std::endl;=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 std::cout=
<< "Encrypted message (hex): ";=C2=A0</div><div dir=3D"aut=
o"><br></div><div dir=3D"auto">=C2=A0 =C2=A0 CryptoPP::StringSource(encrypt=
ed, true,=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 =C2=A0 =C2=A0 new Cryp=
toPP::HexEncoder(=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 new CryptoPP::FileSink(std::cout)</div><div dir=3D"auto">=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 )=C2=A0</div><div dir=3D"auto">=C2=A0);=C2=A0</div=
><div dir=3D"auto"><br></div><div dir=3D"auto">=C2=A0 =C2=A0 std::cout <=
< std::endl;=C2=A0</div><div dir=3D"auto">=C2=A0 =C2=A0 std::cout <&l=
t; "Decrypted message: " << decrypted << std::endl;=
=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">=C2=A0 =C2=A0 =C2=
=A0return 0;</div><div dir=3D"auto">=C2=A0}<br></div><div><br></div><div><b=
r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Jeffrey =
Walton <<a href=3D"mailto:[email protected]">[email protected]</a>>=
schrieb am Di. 16. Apr. 2024 um 21:19:<br></div><blockquote class=3D"gmail=
_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left=
-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)"><div dir=
=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote"><div dir=
=3D"ltr" class=3D"gmail_attr">On Tue, Apr 16, 2024 at 1:44=E2=80=AFPM One S=
ini <<a href=3D"mailto:[email protected]" target=3D"_blank">onesini@gmai=
l.com</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;paddin=
g-left:1ex;border-left-color:rgb(204,204,204)"><div dir=3D"auto"><div><span=
style=3D"font-family:s=C3=B6hne,ui-sans-serif,system-ui,-apple-system,&quo=
t;segoe ui",roboto,ubuntu,cantarell,"noto sans",sans-serif,&=
quot;helvetica neue",arial,"apple color emoji","segoe u=
i emoji","segoe ui symbol","noto color emoji";font=
-size:16px;font-style:normal;font-weight:400;letter-spacing:normal;text-ind=
ent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;text-deco=
ration:none;float:none;display:inline;color:rgb(13,13,13)">I wasn't ent=
irely satisfied with the security, so I've adjusted the code. I'm n=
ot sure if that helps you, depending on what you're doing with it.</spa=
n></div><br></div><div dir=3D"auto"><div><span style=3D"font-family:s=C3=B6=
hne,ui-sans-serif,system-ui,-apple-system,"segoe ui",roboto,ubunt=
u,cantarell,"noto sans",sans-serif,"helvetica neue",ari=
al,"apple color emoji","segoe ui emoji","segoe ui =
symbol","noto color emoji";font-size:16px;font-style:normal;=
font-weight:400;letter-spacing:normal;text-indent:0px;text-transform:none;w=
hite-space:pre-wrap;word-spacing:0px;text-decoration:none;float:none;displa=
y:inline;color:rgb(13,13,13)">This code uses RSA with OAEP (Optimal Asymmet=
ric Encryption Padding) to avoid security issues like padding oracle attack=
s. It generates RSA keys with a length of 2048 bits, encrypts the message w=
ith OAEP padding, and then decrypts it.</span></div><div dir=3D"auto"><span=
style=3D"font-family:s=C3=B6hne,ui-sans-serif,system-ui,-apple-system,&quo=
t;segoe ui",roboto,ubuntu,cantarell,"noto sans",sans-serif,&=
quot;helvetica neue",arial,"apple color emoji","segoe u=
i emoji","segoe ui symbol","noto color emoji";font=
-size:16px;font-style:normal;font-weight:400;letter-spacing:normal;text-ind=
ent:0px;text-transform:none;white-space:pre-wrap;word-spacing:0px;text-deco=
ration:none;float:none;display:inline;color:rgb(13,13,13)"><br></span></div=
><div dir=3D"auto"><span style=3D"font-family:s=C3=B6hne,ui-sans-serif,syst=
em-ui,-apple-system,"segoe ui",roboto,ubuntu,cantarell,"noto=
sans",sans-serif,"helvetica neue",arial,"apple color e=
moji","segoe ui emoji","segoe ui symbol","not=
o color emoji";font-size:16px;font-style:normal;font-weight:400;letter=
-spacing:normal;text-indent:0px;text-transform:none;white-space:pre-wrap;wo=
rd-spacing:0px;text-decoration:none;float:none;display:inline;color:rgb(13,=
13,13)">Best Regards Satoshi </span></div></div></blockquote><div><br></div=
><div>I deleted the message from the group. The *.pdf and *.pages smells of=
malware.</div><div><br></div><div>If you want to provide code, please inli=
ne it or provide it as a text attachment.<br></div><div><br></div><div>Jeff=
</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-c=
olor:rgb(204,204,204)"><div><div class=3D"gmail_quote"><blockquote class=3D=
"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;borde=
r-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)">
</blockquote></div></div></blockquote></div></div>
<p></p>
-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users" group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]" targ=
et=3D"_blank">[email protected]</a>.<br>
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cryptopp-users/CAH8yC8%3DwptAsfC1eM0Up37oZt14dok_C3R%3DqLiwSrbUJ=
HiVNSw%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter" target=
=3D"_blank">https://groups.google.com/d/msgid/cryptopp-users/CAH8yC8%3DwptA=
sfC1eM0Up37oZt14dok_C3R%3DqLiwSrbUJHiVNSw%40mail.gmail.com</a>.<br>
</blockquote></div></div>
<p></p>
-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Crypto++ Users" group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">cryp=
[email protected]</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/cryptopp-users/CAJm61-BxHt2h1D3abpygLrW4ayDxsnTdBEjzB4yftfrM9k7e=
HQ%40mail.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.=
google.com/d/msgid/cryptopp-users/CAJm61-BxHt2h1D3abpygLrW4ayDxsnTdBEjzB4yf=
tfrM9k7eHQ%40mail.gmail.com</a>.<br />
--000000000000a9a4f606163f607b--