Archived Forum Post

Index of archived forum posts

Question:

[AES GCM] Authentication Tag error

Apr 21 '17 at 06:20

Hi,

I am suffering an issue of AES regarding to Authentication Tag.

Here is my purchase receipt

I follow this sample: https://www.example-code.com/java/crypt2_aes_gcm.asp

And modify as bellow:

- After encryption, I create a new instance of CkCrypt2 instead of reusing the existing CkCrypt2 instance (it work well if reusing but I need new an instance of CkCrypt2 to simulate the situation that backend and frontend is exchange plantexts. - Set Key

- Set IV

- Set authentication tag Perform decryption ->>> I always got the error that Authentication tag is wrong, something like:

DllDate: Mar 20 2017
                                                                 ChilkatVersion: 9.5.0.66
                                                                 UnlockPrefix: DRRLWC.CRX0318
                                                                 Architecture: Little Endian; 32-bit
                                                                 Language: Android Java
                                                                 VerboseLogging: 0
                                                                 decryptBytesNew:
                                                                   GCM decrypt authentication tag not equal to the expected value.
                                                                   decryptTag: 1F78 B80F AE3F 6EFF DE70 0C5D 5376 F52F
                                                                   expectedTag: 5BC9 4FBC 3221 A5DB 94FA E95A E712 1A47
                                                                 --decryptBytesNew
                                                                 Failed.
                                                               --DecryptEncoded
                                                             --ChilkatLog

Here is my code:

 public void checkSample() {
    CkCrypt2 crypt = new CkCrypt2();

    boolean success = crypt.UnlockComponent("Anything for 30-day trial");
    if (success != true) {
        System.out.println(crypt.lastErrorText());
        return;
    }

    //  Set the encryption algorithm to "AES"
    crypt.put_CryptAlgorithm("aes");

    //  Indicate that the Galois/Counter Mode (GCM) should be used:
    crypt.put_CipherMode("gcm");

    //  KeyLength may be 128, 192, 256
    crypt.put_KeyLength(128);

    //  This is the 128-bit AES secret key (in hex format)
    String K = "feffe9928665731c6d6a8f9467308308";

    //  This is the 16-byte initialization vector:
    String IV = "cafebabefacedbaddecaf888";

    //  This is the additional data to be used as input to the GCM AEAD algorithm,
    //  but is not included in the output.  It plays a role in the computation of the
    //  resulting authenticated tag.
    String AAD = "feedfacedeadbeeffeedfacedeadbeefabaddad2";

    //  The plain-text bytes (in hex format) to be encrypted.
    String PT = "d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39";

    //  The expected cipher text (in hex format)
    String CT = "42831ec2217774244b7221b784d0d49ce3aa212f2c02a4e035c17e2329aca12e21d514b25466931c7d8f6a5aac84aa051ba30b396a0aac973d58e091";

    //  The expected authenticated tag given the above inputs.
    String T = "5bc94fbc3221a5db94fae95ae7121a47";

    //  Note: The above data are the values for test vector #4 from
    //  the PDF document at: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/gcm/gcm-spec.pdf

    //  EncodingMode specifies the encoding of the output for
    //  encryption, and the input for decryption.
    //  It may be "hex", "url", "base64", or "quoted-printable".
    crypt.put_EncodingMode("hex");

    //  Set the secret key and IV
    crypt.SetEncodedIV(IV,"hex");
    crypt.SetEncodedKey(K,"hex");

    //  Set the additional authenticated data (AAD)
    success = crypt.SetEncodedAad(AAD,"hex");

    //  For the purpose of duplicating the test vectors, we are using the EncryptEncoded method.
    //  This method decodes the input string according to the encoding specified by the EncodingMode
    //  property, which in this case is "hex".  The decoded bytes are encrypted using the mode specified
    //  by the CipherMode property.  The resulting
    //  encrypted bytes are encoded (again using the encoding mode specified by EncodingMode),
    //  and the result is returned.
    //  <b>Note:</b> The CipherMode property sets the block mode of operation (gcm, cfb, cbc, ofb, ecb, etc.)
    //  for any of the Chilkat encryption/decryption methods (such as EncryptBytes, EncryptString,
    //  CkEncryptFile, etc.)   Just because GCM mode is demonstrated with EncryptEncoded/DecryptEncoded,
    //  does not imply that GCM mode is specific to only these methods.
    String ctResult = crypt.encryptEncoded(PT);
    String checkTag = crypt.getEncodedAuthTag("hex");
    Log.d("DEBUG", "checkTag: " + checkTag);
    if (crypt.get_LastMethodSuccess() != true) {
        System.out.println(crypt.lastErrorText());
        return;
    }

    //  Examine the result.  It should be the same (case insensitive) as our expected result:
    System.out.println("computed result: " + ctResult);
    System.out.println("expected result: " + CT);

    //  Examine the authenticated tag. It should be the same (case insensitive) as our expected authenticated tag:
    String tResult = crypt.getEncodedAuthTag("hex");
    Log.d("DEBUG", "checkTag: " + checkTag);
    Log.d("DEBUG", "computed authTag: " + tResult);
    Log.d("DEBUG", "expected authTag: " + checkTag);
    System.out.println("computed authTag: " + T);

    /**
     * =======================
     * DECRYPT MODIFICATION STARTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT
     */
     /**
     * =======================
     * CREATE a NEW INSTANCE of CkCrypt2()
     */
    crypt = new CkCrypt2();

    success = crypt.UnlockComponent("Anything for 30-day trial");
    if (success != true) {
        System.out.println(crypt.lastErrorText());
        return;
    }

    //  Set the encryption algorithm to "AES"
    crypt.put_CryptAlgorithm("aes");

    //  Indicate that the Galois/Counter Mode (GCM) should be used:
    crypt.put_CipherMode("gcm");

    //  KeyLength may be 128, 192, 256
    crypt.put_KeyLength(128);
    /**
     * =======================
     * SetEncodedAuthTag
     */
    success = crypt.SetEncodedAuthTag(T,"hex");
    Log.d("DEBUG", "success>>: " + success);
    crypt.SetEncodedIV(IV,"hex");
    crypt.SetEncodedKey(K,"hex");

    //  -------------------------------------------------------------------------------------
    //  Now let's GCM decrypt...
    //  -------------------------------------------------------------------------------------

    //  Before GCM decrypting, we must set the authenticated tag to the value that is expected.
    //  The decryption will fail if the resulting authenticated tag is not equal (case insensitive) to
    //  the expected result.
    //  Note: The return value of SetEncodedAuthTag indicates whether the string passed was a valid
    //  representation of the encoding specified in the 2nd arg.
    //  All of our properties (IV, secret key, cipher mode, and AAD) are already set from the code above...

    //  So let's decrypt CT to and check to see if we get PT.
    String ptResult = crypt.decryptEncoded(ctResult);
    if (crypt.get_LastMethodSuccess() != true) {
        /**
         * ==================
         ALWAYS GOT THE ERROR:
         DecryptEncoded:
                                                                 DllDate: Mar 20 2017
                                                                 ChilkatVersion: 9.5.0.66
                                                                 UnlockPrefix: DRRLWC.CRX0318
                                                                 Architecture: Little Endian; 32-bit
                                                                 Language: Android Java
                                                                 VerboseLogging: 0
                                                                 decryptBytesNew:
                                                                   GCM decrypt authentication tag not equal to the expected value.
                                                                   decryptTag: 1F78 B80F AE3F 6EFF DE70 0C5D 5376 F52F
                                                                   expectedTag: 5BC9 4FBC 3221 A5DB 94FA E95A E712 1A47
                                                                 --decryptBytesNew
                                                                 Failed.
                                                               --DecryptEncoded
                                                             --ChilkatLog
         */
        //  Failed.  The resultant authenticated tag did not equal the expected authentication tag.
        Log.d("DEBUG", "error>>: " + crypt.lastErrorText());
        System.out.println(crypt.lastErrorText());
        return;
    }

    //  Examine the decrypted result.  It should be the same as our expected plaintext (case insensitive)
    System.out.println("plaintext decrypted: " + ptResult);
    System.out.println("plaintext expected:  " + PT);

    //  Let's intentionally set the expected authenticated tag to an incorrect value.
    //  The decrypt operation should fail:
   /* String tInvalid = "ffaabbbc3221a5db94fae95ae7121a47";

    success = crypt.SetEncodedAuthTag(tInvalid,"hex");

    ptResult = crypt.decryptEncoded(CT);
    if (crypt.get_LastMethodSuccess() != true) {
        Log.d("DEBUG", crypt.lastErrorText());
        //  Failed.  The resultant authenticated tag did not equal the expected authentication tag.
        System.out.println(crypt.lastErrorText());
    }*/
}

Thank you very much,


Answer

Hi Admin,

I know the reason alreay, could you help close the ticke: When decryption, if we don't set EncodedAad to the processor (not only Chilkat), as default it will understand that the sender uses only IV and Key for encryption So, the decrypted cipher will be wrong and the decrypt tag calculated is wrong too Authentication Tag is used for checking Data Integrity, something like MD5 only. It cannot be used to replace AdditionalAuthenticatedData