1
$\begingroup$

I'm trying to implement AES CBC MAC splicing attack in Python, the idea is:

given a message M, its tag Tm (MAC(M) = T), a new message N and its tag Tn we build a message such as: M||N = (M1, ..., Mn, N1 ⊕ Tn, N2, ..., Nn) that has the same tag with N (that is because you inserted a block which resets the algorithm).

The idea is quite clear, but I still cannot get the correct tag.

Here is my code (I'm new to Python, sorry):

from Crypto.Cipher import AES
from Crypto.Util.strxor import strxor
from binascii import hexlify
import argparse
import pickle

AES_KEY_SIZE = 16
BLOCK_SIZE = AES.block_size


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("f1", type=str, help="f1")
    parser.add_argument("f2", type=str, help="f2")
    parser.add_argument("tag1", type=str, help="tag1")
    parser.add_argument("tag2", type=str, help="tag2")
    parser.add_argument("k", type=str, help="key")
    args = parser.parse_args()
    with open(args.tag2, "rb") as tag2:
        stored_tag = pickle.load(tag2)
    with open(args.k, mode="rb") as f:
        key = pickle.load(f)
    assert len(key) == AES_KEY_SIZE
    cipher = AES.new(key, AES.MODE_CBC, b'\0' * BLOCK_SIZE)
    with open(args.f2, mode="rb") as f2:
        f2_block1 = f2.read(BLOCK_SIZE)
        b1 = cipher.encrypt(strxor(f2_block1, stored_tag))
        with open(args.f1, mode="rb") as f1:
            file1 = f1.read()
        file2 = f2.read()
        the_rest_of_the_file = file2[BLOCK_SIZE:len(file2)]
        new = open('newfile.file','w')
        s = file1 + b1 + the_rest_of_the_file
        new.write(s)


if __name__=="__main__":
    main()
$\endgroup$
  • 2
    $\begingroup$ I've tried to answer your question, since ironically the error appears to be in your cryptography rather than your python. In general, questions here shouldn't involve large amounts of code, since the aim should be the study of cryptography as a theoretical science, rather than programming $\endgroup$ – Cryptographeur Mar 26 '14 at 13:33
  • $\begingroup$ @figlesquidge Good catch! Guess this is one of the rare cases that proves questions with code can be on-topic… oh, the irony – always good enough to make me smile on a rainy day. ;) $\endgroup$ – e-sushi Mar 26 '14 at 16:16
3
$\begingroup$

Just for completeness sake, CBC is defined as follows: CBC mode

The error you have made is that:

$$M;N = (M_1, ..., M_n, N_1 ⊕ \mathbf{T_m}, N_2, ..., N_n)$$ (I've changed notation from M||N to M;N to reflect this isn't just concatenation)

You need to cancel the tag from the message $M$, not the tag from the $N$ message. In that case, $T_{M;N}=T_N$ as required.

$\endgroup$
  • $\begingroup$ Don't forget to mark it as closed then! :) $\endgroup$ – Cryptographeur Apr 1 '14 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.