AES update algorithm.

[yermukhanbet]

First of all, thanks for great work!

Me and my team are trying to write encryption algorithm, which has AES as one of the steps.

We got python function with the same encryption algorithm, which runs perfectly fine:

    def password_encrypt(self, password):
        publickeyid, publickey = self.password_publickeys()
        # session_key = get_random_bytes(32)
        session_key = b'\xef\xfd\xa4PnA\x97\xd3\x94\xa6\x1c\xd7\xbd\xe3%j\x84F\xca!\x19\x15w?[\xc3i\x19{\xed\x9e4'
        # iv = get_random_bytes(12)
        iv = b'\x11\xaa\x83\x81\xfa}\xbc\xb9x\xdd\xfb\xb5'
        # timestamp = str(int(time.time()))
        timestamp = '1655691250'
        decoded_publickey = base64.b64decode(publickey.encode())
        recipient_key = RSA.import_key(decoded_publickey)
        cipher_rsa = PKCS1_v1_5.new(recipient_key)
        rsa_encrypted = cipher_rsa.encrypt(session_key)
        cipher_aes = AES.new(session_key, AES.MODE_GCM, iv)
        cipher_aes.update(timestamp.encode())

        # b'\n\xb0\xb5s\xb2A2\xc9\xc3dI\xfd\xa0\xf3\xc5\xc7'
        aes_encrypted, tag = cipher_aes.encrypt_and_digest(password.encode("utf8"))
        size_buffer = len(rsa_encrypted).to_bytes(2, byteorder='little')
        payload = base64.b64encode(b''.join([
            b"\x01",
            publickeyid.to_bytes(1, byteorder='big'),
            iv,
            size_buffer,
            rsa_encrypted,
            tag,
            aes_encrypted
        ]))

        return f"#Foobar:4:{timestamp}:{payload.decode()}"

Remark: we put static values in order to check if the input and output will be same between swift and python functions for encryption.

However, when we compare the outputs between swift and python functions, the value of outputs are different from each other. After debugging, we realized that all encrypted values (password and tag) are the same until it hits update() function in AES, after which encrypted values(password and tag) become different compared to python output.

        let (publickeyid, publickey) = try await passwordPublickeys()
        
        let sessionKey: [UInt8] = [0xef, 0xfd, 0xa4, 0x50, 0x6e, 0x41, 0x97, 0xd3, 0x94, 0xa6, 0x1c, 0xd7, 0xbd, 0xe3, 0x25, 0x6a, 0x84, 0x46, 0xca, 0x21, 0x19, 0x15, 0x77, 0x3f, 0x5b, 0xc3, 0x69, 0x19, 0x7b, 0xed, 0x9e, 0x34]
        let iv: [UInt8] = [0x11, 0xaa, 0x83, 0x81, 0xfa, 0x7d, 0xbc, 0xb9, 0x78, 0xdd, 0xfb, 0xb5]
        let timestamp: String = “1655691250”
        
        let decodedPublicKey = getBase64DecodedKey(publickey)!
        
        
        let modified = decodedPublicKey.split(separator: "\n")
            .joined()
            .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
            .replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
        
        let encryptedSessionKey: Data = encryptRSA(sessionKey, publicKey: modified)!
        let gcm = GCM(iv: iv)
        
        let aes = try AES(key: sessionKey, blockMode: gcm, padding: .noPadding)
        var aesEncryptor = try aes.makeEncryptor()
        var someBytes = try aesEncryptor.update(withBytes: timestamp.bytes)
        let aesEncrypted = try aesEncryptor.finish(withBytes: testPassword.bytes)
        let tag = gcm.authenticationTag!
//        let bufferLengthBytesToLittleEndian = withUnsafeBytes(of: encryptedSessionKey.count.littleEndian, Array<UInt8>.init)
        
        let length: Int = 2 * MemoryLayout<UInt8>.size
        let sizeBuffer = withUnsafeBytes(of: encryptedSessionKey.count) { bytes in Array(bytes.prefix(length)) }
        
        let padding: Data = " ".data(using: .utf8)!
        
        let payloadBytes = Data([
            padding.bytes,
            publickeyid.bytes.reversed(),
            iv,
            sizeBuffer,
            encryptedSessionKey.bytes,
            tag,
            aesEncrypted
        ].joined()).base64EncodedString()
        
        
        let encryptedPassword: String = "#Foobar:4:\(timestamp):\(payloadBytes)"
        
        print(encryptedPassword)

After some research, we found out that there are many different types of authenticated encryption modes( GCM, which we are using ).

However, it seems like python function and swift functions are using the same modes. Therefore, we are kind of confused about different output values.

We are not sure if we are using update function properly, so we were curious if there are any work around with this issue.

Any ideas or solutions to this?