EVP_DecryptFinal_ex中用于解密的最终块的正确格式是什么？

Question

I have implemented a simple AES-256-GCM encryption and decryption for learning purposes. While testing my code if I enter strings lengths multiples of 6 then I get the correct output but for other cases the decrypted data has some garbage characters appended to it.

Case1:
Enter string: abcdef
Enter key: sdasdasdsa
-^%�
abcdef
6

Case2:
Enter string: abcdefghi
Enter key: sadsadsad
򈇢\h�,�[�
abcdefghi�\�
-1

Now I read on the https://www.openssl.org/docs/crypto/EVP_EncryptFinal_ex.html that

EVP_DecryptFinal() will return an error code if padding is enabled and the
final block is not correctly formatted.

But since padding is enabled by default in this case I am guessing that the problem is with the correct formatting of the final block. I have attached my code below:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <openssl/evp.h>

void handleErrors()
{
    printf("Some error occured\n");
}

int encrypt(unsigned char *plaintext, int plaintext_len, unsigned char *aad,
    int aad_len, unsigned char *key, unsigned char *iv,
    unsigned char *ciphertext, unsigned char *tag)
{
    EVP_CIPHER_CTX *ctx;

    int len, ciphertext_len=0;

    /* Create and initialise the context */
    if(!(ctx = EVP_CIPHER_CTX_new()))
        handleErrors();

    /* Initialise the encryption operation. */
    if(1 != EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
        handleErrors();

    /* Set IV length if default 12 bytes (96 bits) is not appropriate */
    if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, 16, NULL))
        handleErrors();

    /* Initialise key and IV */
    if(1 != EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv)) handleErrors();

    /* Provide any AAD data. This can be called zero or more times as
     * required
     */
    if(1 != EVP_EncryptUpdate(ctx, NULL, &len, aad, aad_len))
        handleErrors();

    /* Provide the message to be encrypted, and obtain the encrypted output.
     * EVP_EncryptUpdate can be called multiple times if necessary
     */
    if(1 != EVP_EncryptUpdate(ctx, ciphertext, &len, plaintext, plaintext_len))
        handleErrors();
    ciphertext_len+= len;

    /* Finalise the encryption. Normally ciphertext bytes may be written at
     * this stage, but this does not occur in GCM mode
     */
    if(1 != EVP_EncryptFinal_ex(ctx, ciphertext + len, &len)) handleErrors();
    ciphertext_len += len;

    /* Get the tag */
    if(1 != EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, tag))
        handleErrors();

    /* Clean up */
    EVP_CIPHER_CTX_free(ctx);

    return ciphertext_len;
}


int decrypt(unsigned char *ciphertext, int ciphertext_len, unsigned char *aad,
    int aad_len, unsigned char *tag, unsigned char *key, unsigned char *iv,
    unsigned char *plaintext)
{
    EVP_CIPHER_CTX *ctx;
    int len, plaintext_len=0, ret;

    /* Create and initialise the context */
    if(!(ctx = EVP_CIPHER_CTX_new())) 
        handleErrors();

    /* Initialise the decryption operation. */
    if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL))
        handleErrors();

    /* Set IV length. Not necessary if this is 12 bytes (96 bits) */
    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, 16, NULL))
        handleErrors();

    /* Initialise key and IV */
    if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) handleErrors();

    /* Provide any AAD data. This can be called zero or more times as
     * required
     */
    if(!EVP_DecryptUpdate(ctx, NULL, &len, aad, aad_len))
        handleErrors();

    /* Provide the message to be decrypted, and obtain the plaintext output.
     * EVP_DecryptUpdate can be called multiple times if necessary
     */
    if(!EVP_DecryptUpdate(ctx, plaintext, &len, ciphertext, ciphertext_len))
        handleErrors();
    plaintext_len+= len;

    /* Set expected tag value. Works in OpenSSL 1.0.1d and later */
    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, tag))
        handleErrors();

    /* Finalise the decryption. A positive return value indicates success,
     * anything else is a failure - the plaintext is not trustworthy.
     */
    ret = EVP_DecryptFinal_ex(ctx, plaintext + len, &len);

    /* Clean up */
    EVP_CIPHER_CTX_free(ctx);

    if(ret > 0)
    {
        /* Success */
        plaintext_len += len;
        return plaintext_len;
    }
    else
    {
        /* Verify failed */
        return -1;
    }
}


int main (void)
{
    unsigned char str[1024],key[10],ciphertext[1024+EVP_MAX_BLOCK_LENGTH],tag[100],pt[1024];
    unsigned char iv[]="1234567890abcdef";
    unsigned char aad[]="1234567890123456";
    int k;
    printf("Enter string: ");
    scanf("%s",str);
    printf("Enter key: ");
    scanf("%s",key);

    encrypt(str, strlen(str), aad, strlen(aad), key, iv, ciphertext, tag);
    printf("%s\n",ciphertext);
    k = decrypt(ciphertext, strlen(ciphertext), aad, strlen(aad), tag, key, iv, pt);
    printf("%s\n%d\n",pt,k);
}

Answer 1

decrypt(ciphertext, strlen(ciphertext), aad, strlen(aad), tag, key, iv, pt);

decrypt(ciphertext, strlen(ciphertext), ... is wrong. There could be an embedded NULL in the cipher text, in which case it will be truncated. In your case, additional characters are being fed to the decrypt function. Its hard to say how many - its until strlen happen to run into a NULL in memory.

You need to capture the return value of encrypt and decrpyt to set various length's properly:

int x;
...

x = encrypt(str, strlen(str), aad, strlen(aad), key, iv, ciphertext, tag);
...

x = decrypt(ciphertext, x, aad, strlen(aad), tag, key, iv, pt);
...

You might have the same problem for aad, strlen(aad) , but I don't think it has revealed itself yet.

---

What is the correct format for final block in EVP_DecryptFinal_ex for decryption?

To get back to the titular question: there is none. Your problem lies elsewhere.

---

You probably have an overflow in the unsigned char *plaintext buffer used in the decrypt function. You're not passing in a length, so decrypt happily writes beyond the length of it...

Answer 2

In the above example you are defining your key, IV data to be strings. A key and IV should never consist of a string as they do not contain any possible byte. This is required to maximize the amount of security; currently you are limiting the amount of possible keys. Keys should be generated by a function whose output is indistinguishable from random.

You should use a Password Key Derivation Function (PBKDF) such as PBKDF2 to create a key from a password. The IV should be random and send with the ciphertext. The IV and key should be statically sized, the IV being 16 bytes and the key 16, 24 or 32 bytes.

To test however you could use simple array initialization (32 bytes for the key as you are using AES-256):

unsigned char key[32] = { 0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
                          0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
                          0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
                          0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00 };
unsigned char iv[16] = { 0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,
                         0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00,  0x00 };

or you could allocate X bytes of memory and fill it with a value of course, as long as you give the function the correct size.

You need to replace all occurrences of strlen() with sizeof() , except for plaintext and ciphertext . In the former you are actually encrypting a string, so strlen makes sense. In the latter you need to use the result of the encrypt operation. The ciphertext is contained within a buffer of the length (correctly) returned by your encryption method.

In the end modern ciphers operate on bytes instead of characters , so you need to provide the size in bytes for all input. This kind of issue is present for any language that treats bytes and characters using the same primitive type ( char for the C-language of course). It also tends to hide encoding/decoding issues (eg with regards to UTF-8).

If you want to handle unknown lengths then you have to call EVP_EncryptUpdate or EVP_DecryptUpdate multiple times, keeping score on how many bytes are returned (as you are doing now). Then at the end of the input you simply call the update method a final time and then call EVP_EncryptFinal_ex or EVP_DecryptFinal_ex . In that case you should of course refactor your method into an init/update/final part and use some buffer for the input and output.