Repository navigation
ndncert: fix v0.3 session cryptography - #236
Closed
markverick wants to merge 3 commits into
Closed
markverick wants to merge 3 commits into
markverick wants to merge 3 commits into
Conversation
Initialize ECDH and IV state for every NEW request rather than once per Client. Cover sequential reuse, failed NEW attempts, and CA signature validation with distinct CA and requester keys.
Start IV counters at zero, encode them in big-endian order, and advance after encryption using integer block counts. Reject empty plaintext, oversized GCM messages, and exhausted counters without wrapping. Add reference-encryption, block arithmetic, and send-exhaustion regression tests.
Reject malformed cipher messages, changing or colliding IV prefixes, replayed or overlapping block ranges, and receive-counter wraparound. Update peer state only after authentication and validation, and decrypt into a private buffer without modifying the packet. Cover authenticated receive-state transitions and a two-round client CHALLENGE exchange against an independent AES-GCM peer, including replay rejection.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Security-sensitive session-state changes and intentional wire-format and API incompatibilities warrant human security and interoperability review.
No open issues 🎉
What changed in this PR
This PR addresses #201 by aligning NDNCERT client session cryptography with v0.3 counter encoding, IV validation, and ephemeral-key requirements.
Changes:
- Generate fresh ECDH keys and IV state for each NEW request.
- Use big-endian, post-encryption counters and reject malformed messages, replayed or overlapping ranges, prefix violations, and counter exhaustion.
- Update decryption callers and add regression tests for session reuse, authentication, and multi-round CHALLENGE exchanges.
| File | Description |
|---|---|
std/security/ndncert/crypto_aes.go |
Corrects counter handling and adds session-aware IV validation. |
std/security/ndncert/crypto_aes_test.go |
Tests encoding, exhaustion, authentication, replay rejection, and buffer preservation. |
std/security/ndncert/client.go |
Adds fresh key and IV state initialization per session. |
std/security/ndncert/client_session_test.go |
Tests sequential sessions, CHALLENGE exchanges, and signature validation. |
std/security/ndncert/client_protocol.go |
Initializes sessions during NEW and handles stateful decryption errors. |
Review effort: Balanced
Collaborator
Author
|
will merge in a branch instead for a proper stacked PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #201.
The client currently encodes IV counters in little-endian order,
increments them before encryption, and does not track received IVs.
Reusing a Client also reuses its ephemeral ECDH key across requests.
after encryption using integer plaintext block counts.
replayed or overlapping counter ranges, and counter exhaustion.
Low-level callers must now pass the session's AeadCounter to
AeadDecrypt and handle errors returned by AeadMessage.FromTLV.
Peers using the previous IV format need coordinated updates.
Regression tests cover sequential sessions, counter encoding and
exhaustion, malformed messages, signature validation, and two-round
CHALLENGE exchanges with replay rejection.
Validation: