libsodium

igher level construct (e.g: crypto_secretstream, also from libsodium), but as far as I can tell at first glance, this is a working implementation of X25519. 1: https://github.com/jedisct1/libsodium/blob/7993f5ec5199b6637...

only document the encryption protocols). First, the authors' problems appear to stem from their choice to manually implement an unusual (and inefficient) construction of the Authenticated Encryption primitive. Authenticated Encryption is the most common crypto primitive that people when they say "they want encryption." It's placed front-and-center in libsodium, ring, mundane, tink, monocypher, and every modern cryptography library that I've seen, since it is such a common operation. Modern Authenticated Encryption constructions include: AES-GCM, (X)ChaCha20-Poly1305. While there exist others, the industry has converged on these two as the standard. These block cipher modes did not emerge for no reason. The cryptography community has steadily iterated on what the default should be when somebody asks, "how can I encrypt my file." We've arrived at these constructions, in particular, because previous constructions have had security flaws. The authors of this repo have chosen to use the following protocol (for decryptDataPBKDF2): 1. Derive two keys (KE, KH) from a password string using PBKDF2. KE is the encryption key used with AES, and KH is an HMAC key (used for multiple purposes, which is problematic). 2. Read the AES-CBC initialization vector, IV. Read the AES-CBC ciphertext, C. 3. Check HMAC(KH, C) == the tag in the file. 4. Output AES-CBC-DECRYPT(KE, IV, C) with PKCS#5 padding. The core of the problem is that, while they use the HMAC to check that the ciphertext is authentic (which is a bit odd, given that they seem to claim that authenticity shouldn't matter), they never check that the IV is authentic (it's never computed in the HMAC). The way that AES-CBC decryption works, for first 16-bytes of the decryption is AES-BLOCK-DECRYPT(KE, first 16 bytes of C) XOR IV. As a result, if the IV isn't authenticated (which it's not), then any bit that the attacker flips in the IV will flip the corresponding bit in the ciphertext. Because PKCS#5 padding is used, given a padding oracle, an adversary could decrypt messages under 16 bytes in length. The moral of the story is DO NOT ROLL YOUR OWN CRYPTO! Rolling your own crypto can be fun and educational and informative, but DON'T DEPLOY IT! This bug should not have arisen, because the GitHub link in this blog post should've been to https://github.com/google/tink or https://github.com/jedisct1/libsodium or some library like them.

client is here[2], and you can check out the roadmap[3]. Shoutouts to these great tools that made it possible: - libsodium[4], and it's JS version, are used for the end-to-end encryption - StreamSaver.js[5], to save large files from a non-HTTP transport without buffering it in RAM. Had to patch it to add back pressure when the download is paused. Current limitations: - p2p only works on local networks, wait until WebRTC transport is implemented in the server - when downloading several files, a Zip is generated, with a 4Gb size limit, wait until I figure out the way to fix this. With a single file, it's downloaded in plain and without limits. Please roast this thing! -- [1] PlayStore: https://play.google.com/store/apps/details?id=im.recall.android [2] Web client: http://web.recall.im [3] Roadmap: https://recall.im [4] LibSodium: https://github.com/jedisct1/libsodium [5] StreamSaver.js: https://github.com/jimmywarting/StreamSaver.js [*] A demo of some files I shared, served by my phone: http://web.recall.im/#peer=c7e0f38a7f60752b4fa3017807fc731f2c8cb87b3d7d35c8131196c…

about your use case? [1] https://github.com/jedisct1/libsodium [2] https://github.com/google/tink

evel niche and suffers from being held back by C and its notoriously anemic standard library.

tively straightforward operation https://github.com/jedisct1/libsodium/blob/master/src/libsod...

eavy, I have printed it) C99 specifications: Addition or subtraction of a pointer into, or just beyond, an array object and an integer type produces a result that does not point into, or just beyond, the same array object. (6.5.6) That's what caused the bug: we were taking a pointer from an array, then used it to overflow past it. It didn't matter that we could access the memory there. What mattered is that we locally overflew that array. Had we computed the pointer by first working with the outer array, then pointed to the right element, we'd have the same pointer, except this time it wouldn't be undefined. Bonus note: you don't even have to dereference the pointer, computing its value is enough to trigger undefined behaviour. Here is some more undefined behaviour I have removed (it's subtle, relatively few programmers know this): Pointers that do not point into, or just beyond, the same array object are subtracted. (6.5.6) There go flat memory models. Though to be honest, even segmented memory models could define that. Just make the subtraction already, it doesn't have to mean anything. Make it unspecified or implementation defined at least. Pointers that do not point to the same aggregate or union (nor just beyond the same array object) are compared using relational operators (6.5.8) That's the reason we can't implement memmove() portably and efficiently. And depending which tool you ask, even converting the pointers to intptr_t first isn't enough. Real world example here: https://github.com/jedisct1/libsodium/commit/e7e378fad116c18... --- If you haven't already, go read the annex J from the C standard. Ponder the fact that compilers, unless you specifically ask not to (-fwrapv), will exploit every single one, even on platform that could define some reasonable behaviour (2's complement machines). It may hint at how hostile C is to programmers who care about correctness. Believe me, I know. I wrote a whole Crypto library[1], and that's one of the easiest things to get right, where C is concerned. I mean, the crypto itself is hard, but the total lack of dependency makes it pathologically easy to write in a portable way. Yet C still makes it hard. [1] https://monocypher.org