Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LegacyDecryptor and LegacyDecryptorWithMAC use wrong MAC #714

Closed
noloader opened this issue Sep 11, 2018 · 3 comments
Closed

LegacyDecryptor and LegacyDecryptorWithMAC use wrong MAC #714

noloader opened this issue Sep 11, 2018 · 3 comments
Labels

Comments

@noloader
Copy link
Collaborator

Crypto++ 6.0 changed DefaultDecryptor and DefaultDecryptorWithMAC to use modern algorithms. Also see Issue 345.

At that time we also provided LegacyDecryptor and LegacyDecryptorWithMAC for folks who needed interop with the older algorithm. We botched the interop by using the new MAC (SHA256-based) instead of the old MAC (SHA1-based). Also see Update DefaultEncryptor, DefaultEncryptorWithMAC and friends.

This ticket will track the change to LegacyDecryptor and LegacyDecryptorWithMAC for SHA1-based MACs.

@noloader noloader added the Bug label Sep 11, 2018
noloader added a commit that referenced this issue Sep 11, 2018
The classes used the wrong hash with the MAC. The legacy gear should have used SHA1, not SHA256.
@noloader
Copy link
Collaborator Author

Cleared at Commit 590f8573c4ed.

@AndiDog
Copy link

AndiDog commented Oct 19, 2018

Can this make it into a release soon? This has been wrong all the way between [6.0.0, 7.0.0] and without the patch, we cannot safely replace existing code to use the legacy algorithms.

@noloader
Copy link
Collaborator Author

@AndiDog,

Right now we are blocking on #649 .

I wanted to get a few more things added before the next release but I have not had time. I think its time to shit or get off the pot. We'll release as soon as we clear the AES problems on Windows.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants