<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">cshake_input_s()'s padlen computation,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> padlen = ctx->blocksize - (len_written % ctx->blocksize);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">does not handle the case where len_written is already an exact<o:p></o:p></p>
<p class="MsoNormal">multiple of ctx->blocksize: the modulo evaluates to 0, so padlen<o:p></o:p></p>
<p class="MsoNormal">comes out as ctx->blocksize (a full block) instead of 0. SP 800-185's<o:p></o:p></p>
<p class="MsoNormal">bytepad (sec. 2.3.3) specifies padding with zero bytes only until the<o:p></o:p></p>
<p class="MsoNormal">total length becomes a multiple of the rate -- when it already is,<o:p></o:p></p>
<p class="MsoNormal">no padding bytes should be added at all.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The bug results in a full extra block of zero bytes added to the<o:p></o:p></p>
<p class="MsoNormal">Keccak sponge, producing a wrong cSHAKE digest whenever the encoded<o:p></o:p></p>
<p class="MsoNormal">N (function-name string) + S (customization string) length lands<o:p></o:p></p>
<p class="MsoNormal">exactly on a rate boundary (168 bytes for cSHAKE128, 136 for<o:p></o:p></p>
<p class="MsoNormal">cSHAKE256). <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Concretely: cSHAKE128 with an empty N and a 161-byte S<o:p></o:p></p>
<p class="MsoNormal">(2-byte rate prefix + 2-byte encode_string(empty N) + 3-byte<o:p></o:p></p>
<p class="MsoNormal">encode_string(S) length-prefix + 161 == 168 == the cSHAKE128 rate)<o:p></o:p></p>
<p class="MsoNormal">triggers it; cSHAKE256 with an empty N and a 129-byte S hits the<o:p></o:p></p>
<p class="MsoNormal">same condition against its 136-byte rate.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Found via NIST ACVP cSHAKE-128/256 conformance vectors: a fixture<o:p></o:p></p>
<p class="MsoNormal">covering random S lengths reliably produces a wrong digest at S = 161<o:p></o:p></p>
<p class="MsoNormal">(cSHAKE128) and S = 129 (cSHAKE256), and only those lengths (adjacent<o:p></o:p></p>
<p class="MsoNormal">lengths pass), consistent with this exact rate-boundary condition.<o:p></o:p></p>
<p class="MsoNormal">Confirmed against libgcrypt 1.11.2 and 1.12.0 (unchanged between the<o:p></o:p></p>
<p class="MsoNormal">two).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Signed-off-by: Jonathan Plata <jonathan.plata@lightshipsec.com><o:p></o:p></p>
<p class="MsoNormal"><b>---</b><o:p></o:p></p>
<p class="MsoNormal"> cipher/keccak.c | 2 +-<o:p></o:p></p>
<p class="MsoNormal"> 1 file changed, 1 insertion(+), 1 deletion(-)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">diff --git a/cipher/keccak.c b/cipher/keccak.c<o:p></o:p></p>
<p class="MsoNormal">index a0ba1fbb..1351da16 100644<o:p></o:p></p>
<p class="MsoNormal">--- a/cipher/keccak.c<o:p></o:p></p>
<p class="MsoNormal">+++ b/cipher/keccak.c<o:p></o:p></p>
<p class="MsoNormal"><b>@@ -1694,7 +1694,7 @@</b> cshake_input_s (KECCAK_CONTEXT *ctx, const void *s, unsigned int s_len,<o:p></o:p></p>
<p class="MsoNormal"> keccak_write (ctx, s, s_len);<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> len_written += buf[0] + 1 + s_len;<o:p></o:p></p>
<p class="MsoNormal">- padlen = ctx->blocksize - (len_written % ctx->blocksize);<o:p></o:p></p>
<p class="MsoNormal">+ padlen = (ctx->blocksize - (len_written % ctx->blocksize)) % ctx->blocksize;<o:p></o:p></p>
<p class="MsoNormal"> memset (buf, 0, padlen);<o:p></o:p></p>
<p class="MsoNormal"> keccak_write (ctx, buf, padlen);<o:p></o:p></p>
<p class="MsoNormal"> }<o:p></o:p></p>
<p class="MsoNormal">-- <o:p></o:p></p>
<p class="MsoNormal">2.34.1<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="97%" style="width:97.7%;border-collapse:collapse">
<tbody>
<tr style="height:80.85pt">
<td width="11%" valign="top" style="width:11.66%;padding:0cm 5.4pt 0cm 5.4pt;height:80.85pt">
<p class="MsoNormal"><span style="mso-fareast-language:EN-CA"><img width="60" height="64" style="width:.625in;height:.6666in" id="Picture_x0020_1" src="cid:image001.png@01DD4040.AC77CD40"><span style="mso-ligatures:none"><o:p></o:p></span></span></p>
</td>
<td width="88%" valign="top" style="width:88.34%;padding:0cm 5.4pt 0cm 5.4pt;height:80.85pt">
<p class="MsoNormal"><b><span style="mso-ligatures:none;mso-fareast-language:EN-CA">Jonathan Plata
</span></b><span style="color:#A6A6A6;mso-ligatures:none;mso-fareast-language:EN-CA">|</span><b><span style="mso-ligatures:none;mso-fareast-language:EN-CA"> Software Developer</span></b><span style="mso-ligatures:none;mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="color:#3771C8;mso-ligatures:none;mso-fareast-language:EN-CA">Lightship Security, Inc.<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="mso-ligatures:none;mso-fareast-language:EN-CA">Tel: 512-362-6594<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none;mso-fareast-language:EN-CA"><a href="https://lightshipsec.com/"><span style="color:#0563C1">https://lightshipsec.com</span></a><u><span style="color:#0070C0"><o:p></o:p></span></u></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:9.0pt;mso-ligatures:none;mso-fareast-language:EN-CA">This email and attachments are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the named addressee,
you may not disseminate, distribute or copy this email. Please notify the sender immediately if you have received this email in error and delete it from your system.</span><span style="font-size:9.0pt;mso-ligatures:none;mso-fareast-language:EN-CA"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>