C 中的 OpenSSL AEAD 解密

Question

I have the following code to decrypt some AEAD encrypted password:

int aead_decrypt(char *cipher_password, int len_cipher_password, char *tag, char *key, char *iv, int len_iv, char **plaintext_password) {
    EVP_CIPHER_CTX *ctx;
    int len;
    int plaintext_len;

    // Cipher_password len always greater or equal to plaintext
    *plaintext_password = (unsigned char *)malloc(len_cipher_password);
    if(*plaintext_password == 0) {
        fprintf(stderr, "malloc() failure\n");
        free(*plaintext_password);
        return -1;
    }

    if(!(ctx = EVP_CIPHER_CTX_new())) {
        fprintf(stderr, "EVP_CIPHER_CTX_new() failure\n");
        ERR_print_errors_fp(stderr);
        return -1;
    }

    if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL)) {
        fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
        ERR_print_errors_fp(stderr);
        return -1;
    }

    if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) {
        fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
        ERR_print_errors_fp(stderr);
        return -1;
    }

    if(!EVP_DecryptUpdate(ctx, *plaintext_password, &len, cipher_password, len_cipher_password)) {
        //if(!EVP_DecryptUpdate(ctx, *plaintext_password, &len, padded_cipher_password, len_padded_cipher_password)) {
        fprintf(stderr, "EVP_DecryptUpdate() failure\n");
        ERR_print_errors_fp(stderr);
        return -1;
    }

    if(1!=EVP_DecryptFinal_ex(ctx, *plaintext_password+len, &len)) {
        fprintf(stderr, "EVP_DecryptFinal_ex() failure\n");
        ERR_print_errors_fp(stderr);
        ERR_print_errors_fp(stdout);
        return -1;
    }

    plaintext_len += len;
    (*plaintext_password)[plaintext_len] = '\0';
    EVP_CIPHER_CTX_free(ctx);

    return 1;
}

My problem is that the EVP_DecryptFinal_ex() function always fail but without printing any errors. My plaintext_password comes out decrypted but with 16 bytes of garbage at the end because the EVP_DecryptUpdate() function doesn't return the good plaintext_password_len . I thought at first it was because of padding, my cipher_password is often 24-25 bytes long, so i tried adding some as we can see in the different comments but it did not worked out. (Also i know i pass some parameters i don't use but that's not what's important here). I don't know where the problem could be and i'm not that familiar with the OpenSSL library.

Answer 1

Got it, i was actually confusing aad and tag values. In Authenticated encryption the tag value is always generated (can't be null). In my example it was the default size: 16 bytes. Tag value is then appended to the cipher data. You can use it to authenticate your decrypted data.

Here is my fixed code:

int aead_decrypt(char *cipher_password, int len_cipher_password, char *key, char *iv, int len_iv, char **plaintext_password) {
    EVP_CIPHER_CTX *ctx;
    int len;
    int plaintext_len;

    // The tag is appended at the end of the cipher data
    int tag_offset = len_cipher_password-16;

    // Cipher_password len always greater or equal to plaintext
    *plaintext_password = (unsigned char *)malloc(len_cipher_password);
    if(*plaintext_password == 0) {
            fprintf(stderr, "malloc() failure\n");
            free(*plaintext_password);
            return -1;
    }

    if(!(ctx = EVP_CIPHER_CTX_new())) {
            fprintf(stderr, "EVP_CIPHER_CTX_new() failure\n");
            ERR_print_errors_fp(stderr);
            return -1;
    }

    if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL)) {
            fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
            ERR_print_errors_fp(stderr);
            return -1;
    }

    if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) {
            fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
            ERR_print_errors_fp(stderr);
            return -1;
    }

    // Set the expected tag value for authenticated data
    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, cipher_password+tag_offset)) {
            fprintf(stderr, "EVP_CIPHER_CTX_ctrl() failure\n");
            ERR_print_errors_fp(stderr);
            return -1;
    }

    if(!EVP_DecryptUpdate(ctx, *plaintext_password, &len, cipher_password, tag_offset)) {
            fprintf(stderr, "EVP_DecryptUpdate() failure\n");
            ERR_print_errors_fp(stderr);
            return -1;
    }

    plaintext_len = len;

    if(1!=EVP_DecryptFinal_ex(ctx, *plaintext_password+len, &len)) {
            fprintf(stderr, "EVP_DecryptFinal_ex() failure\n");
            ERR_print_errors_fp(stderr);
            ERR_print_errors_fp(stdout);
    }

    plaintext_len += len;
    (*plaintext_password)[plaintext_len] = '\0';
    EVP_CIPHER_CTX_free(ctx);

    return 1;}