Alan Coopersmith <[email protected]> writes: >The common failure is accepting the sender provided length for the >authentication tag, and not enforcing the minimum length specified in the RFC >- allowing an attacker to specify a one-byte tag length and then use brute >force to determine which of the 256 possible values matches the first byte of >the actual tag.
As with far too many other RFCs, the required skill for them isn't implementing them correctly, it's knowing which bits you need to ignore in order to implement them appropriately. I just checked my code and it hardcodes an allowed MAC length range of 16 ... 64 bytes for RFC 6476 use (Authenticated-Enveloped-Data, but with an explicit MAC), so no matter what any RFC says you can't feed it a MAC value less than 128 bits. And an additional thought, these are all very high-visibility libraries and therefore obvious targets for checking whether they get it right. Given the failure rate with those, I wonder how many other lesser-known ones also got it wrong? Peter.
