def encryptParams(userdata):
userdata = userdata.replace(';', '%3B').replace('=', '%3D')
x1 = b'comment1=cooking%20MCs;userdata='
x2 = b';comment2=%20like%20a%20pound%20of%20bacon'
params = x1 + userdata.encode('ascii') + x2
cipher = challenge10.CBC(AES.new(key, AES.MODE_ECB), iv)
return cipher.encrypt(util.padPKCS7(params, 16))
def encryption_oracle(s):
global key
if key is None:
key = util.randbytes(16)
cipher = AES.new(key, AES.MODE_ECB)
s = util.padPKCS7(s + base64.b64decode(encodedSuffix), 16)
return cipher.encrypt(s)
def encryptParams(userdata):
userdata = userdata.replace(';', '%3B').replace('=', '%3D')
x1 = b'comment1=cooking%20MCs;userdata='
x2 = b';comment2=%20like%20a%20pound%20of%20bacon'
params = x1 + userdata.encode('ascii') + x2
cipher = challenge18.CTR(AES.new(key, AES.MODE_ECB), nonce)
return cipher.encrypt(util.padPKCS7(params, 16))
def encryption_oracle(s):
global key
if key is None:
key = util.randbytes(16)
cipher = AES.new(key, AES.MODE_ECB)
s = util.padPKCS7(s + base64.b64decode(encodedSuffix), 16)
return cipher.encrypt(s)
def oracle_cbc(P):
request = format_request(P)
compressed_request = zlib.compress(request.encode('ascii'))
key = util.randbytes(16)
iv = util.randbytes(16)
cipher = AES.new(key, AES.MODE_CBC, iv)
encrypted_request = cipher.encrypt(util.padPKCS7(compressed_request, 16))
return len(encrypted_request)
def encryption_oracle(s):
global key
global prefix
if key is None:
key = util.randbytes(16)
if prefix is None:
# TODO(akalin): Extend to arbitrary sizes.
randcount = random.randint(16, 32)
prefix = util.randbytes(randcount)
cipher = AES.new(key, AES.MODE_ECB)
s = util.padPKCS7(prefix + s + base64.b64decode(challenge12.encodedSuffix), 16)
return cipher.encrypt(s)
def encryption_oracle(s):
key = util.randbytes(16)
cipher = AES.new(key, AES.MODE_ECB)
if random.randint(0, 1) == 0:
print('Encrypting with ECB')
else:
print('Encrypting with CBC')
IV = util.randbytes(16)
cipher = challenge10.CBC(cipher, IV)
s = util.randbytes(random.randint(5, 10)) + s + util.randbytes(random.randint(5, 10))
s = util.padPKCS7(s, 16)
return cipher.encrypt(s)
def encryption_oracle(s):
global key
global prefix
if key is None:
key = get_random_bytes(16)
if prefix is None:
# TODO(akalin): Extend to arbitrary sizes.
randcount = randint(16, 32)
prefix = get_random_bytes(randcount)
cipher = AES.new(key, AES.MODE_ECB)
s = util.padPKCS7(prefix + s + base64.b64decode(challenge12.encodedSuffix),
16)
return cipher.encrypt(s)
def attacker2_process_message(m):
print('A2', m)
if re.match(b'^from=Tom&', m):
message = m[:-16]
mac1 = m[-16:]
# Assume attacker can create this account, and that this
# message fails or otherwise has no effect.
frontend2_send_message(b'M', [[b'M', b'0'], [b'Mallory', b'1000000']])
m2 = attacker2_peek_last_sent_message()
m3 = util.padPKCS7(message, 16) + strxor(mac1, m2[:16]) + m2[16:]
print('A2', m3)
backend2_process_message(m3)
else:
backend2_process_message(m)
def attacker2_process_message(m):
print('A2', m)
if re.match(b'^from=Tom&', m):
message = m[:-16]
mac1 = m[-16:]
# Assume attacker can create this account, and that this
# message fails or otherwise has no effect.
frontend2_send_message(b'M', [[b'M', b'0'], [b'Mallory', b'1000000']])
m2 = attacker2_peek_last_sent_message()
m3 = util.padPKCS7(message, 16) + strxor(mac1, m2[:16]) + m2[16:]
print('A2', m3)
backend2_process_message(m3)
else:
backend2_process_message(m)
def ciphertext_oracle():
s = base64.b64decode(random.choice(strings))
iv = util.randbytes(16)
cipher = challenge10.CBC(AES.new(key, AES.MODE_ECB), iv)
return (iv, cipher.encrypt(util.padPKCS7(s, 16)))
import util
if __name__ == '__main__':
x = b'YELLOW SUBMARINE'
expectedY = b'YELLOW SUBMARINE\x04\x04\x04\x04'
y = util.padPKCS7(x, 20)
print(y)
print(expectedY)
if y != expectedY:
raise Exception(y + b' != ' + expectedY)
def CBC_Mac(passsword, iv, plain): #return the vaule of the CMAC
cipher = AES.new(d, AES.MODE_CBC, iv)
c = cipher.encrypt(util.padPKCS7(plain, 16))
return c[-16:]
def prependAndCollide(s, prefix):
prefixHash = insecureHash(prefix)
paddedPrefix = util.padPKCS7(prefix, 16)
return paddedPrefix + strxor(s[:16], prefixHash) + s[16:]
def Collide(before, after):
afterHash = CBC_Mac(b'YELLOW SUBMARINE', b'\x00' * 16, after)
padded = util.padPKCS7(after, 16)
return padded + strxor(before[:16], afterHash) + before[16:]
def CBC_MAC(key, iv, p):
cipher = AES.new(key, AES.MODE_CBC, iv)
c = cipher.encrypt(util.padPKCS7(p, 16))
return c[-16:]
def encrypt_profile_for(email):
cipher = AES.new(key, AES.MODE_ECB)
encoded_profile = util.padPKCS7(profile_for(email), 16)
return cipher.encrypt(encoded_profile)
def prependAndCollide(s, prefix):
prefixHash = insecureHash(prefix)
paddedPrefix = util.padPKCS7(prefix, 16)
return paddedPrefix + strxor(s[:16], prefixHash) + s[16:]
def CBC_MAC(key, iv, p):
cipher = AES.new(key, AES.MODE_CBC, iv)
c = cipher.encrypt(util.padPKCS7(p, 16))
return c[-16:]
def encrypt_profile_for(email):
cipher = AES.new(key, AES.MODE_ECB)
encoded_profile = util.padPKCS7(profile_for(email), 16)
return cipher.encrypt(encoded_profile)
def encrypt(self, key, iv, message):
cipher = AES.new(key, AES.MODE_CBC, iv)
return cipher.encrypt(util.padPKCS7(message.encode('ascii'), 16))
