mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-11-05 08:13:06 +08:00
Chris Tate
b161d0be13
A CCM decipher skipped its one update() when the data was empty, and final() accepted when an update had run without failing, so it never compared the tag. setAuthTag() with any tag of the right length, then update() with empty data, then final(), succeeded: anyone could forge an empty message, or one with different AAD or a different declared plaintextLength, without the key. A decipher's update() now runs the authenticated decryption for empty data too. As in OpenSSL, the tag covers the nonce, the AAD and the length, so the right tag still opens an empty message and any other tag, AAD or length fails in final() with "Unsupported state or unable to authenticate data". final() succeeds only after a tag comparison has succeeded. A cipher's empty update() is unchanged.