RE: Bug in CSM_Common::UnloadParams and CSM_Common::SMTI_DecryptA ES

Eric:

After investigating why CSM_Common::UnloadParams(...) would return NULL, it
expects the parameters buffer to contain an ASN.1 encoded "TDESParameters"
data type (just like 3DES), as described in the AES specification from NIST.
I would suggest that you check your data to be sure the parameters are of
the form:

TDESParameters ::= OCTET STRING

This length may vary depending the chosen AES algorithm.  It cannot be a
NULL parameter (length 2, beginning with 0x05).  It must contain the
initialization vector.

The second comment is an error, thank you for pointing this out.  The next
baseline will now check for the "pIV" parameter to be non-NULL before
continuing.  This will force the presence of a proper encoding of the
parameter.  The SMTI_DecryptAES(...) method can afford to expect a decoded
parameter since it is only called from within a CTIL (protected) and ignore
the ASN.1 encoded version of the parameter (1st parameter).  The reason for
the 2 parameters was to allow the individual CTILs to return the decoded
parameters to the application, without requiring the application (in this
case, the SFL) to be aware of the individual parameter encodings.

Bob Colestock
VDA

-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Monday, August 13, 2001 8:32 AM
To: [email protected]
Subject: Bug in CSM_Common::UnloadParams and CSM_Common::SMTI_DecryptAES



Hi,

I think i have found a litle bug in CSM_Common::UnloadParams(CSM_OID
*pPrefContentOid, CSM_Buffer &parameters, int &effectiveKeyBits).

The bug is that the function return NULL if i use AES when i want to
decrypt with CSM_Free3::SMTI_Decrypt(CSM_Buffer *pParameters, CSM_Buffer
*pEncryptedData, CSM_Buffer *pMEK, CSM_Buffer *pData).

The other bug, if it's a bug, is that the first parameter (CSM_Buffer
*pParameters) is never used and the last parameter (CSM_Buffer *pIV) is
never validated (if pIv == NULL do semething).  All this are in
CSM_Common::SMTI_DecryptAES.



**************************************************************************
Eric Boudreault
------------------------------------------------
Programmeur
------------------------------------------------
Motus Technologies
390, St-Vallier Est
Bureau 100
Québec, Qc
G1K 3P6
Tél.: 521-2100  ext.#242
Fax.: 521-2101
courriel: [email protected]
**************************************************************************