From 3748f299f9bf2607e9da047024d12c2c739ac38c Mon Sep 17 00:00:00 2001 From: Michael Vrable Date: Wed, 27 Jan 2010 17:06:04 -0800 Subject: [PATCH] Switch to CTR instead of CBC mode for encryption. This should handle arbitrarily messages better. Later we ought to switch to something like EAX, so consider this change temporary. --- bluesky/crypto.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/bluesky/crypto.c b/bluesky/crypto.c index 4490e8c..5b22357 100644 --- a/bluesky/crypto.c +++ b/bluesky/crypto.c @@ -20,6 +20,8 @@ * the functions in this file, so this is the only point where we interface * with an external cryptographic library. */ +/* TODO: We ought to switch to an authenticated encryption mode like EAX. */ + GCRY_THREAD_OPTION_PTHREAD_IMPL; void bluesky_crypt_init() @@ -64,8 +66,8 @@ BlueSkyRCStr *bluesky_crypt_encrypt(BlueSkyRCStr *in, const uint8_t *key) gcry_error_t status; gcry_cipher_hd_t handle; - status = gcry_cipher_open(&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CBC, - GCRY_CIPHER_CBC_CTS); + status = gcry_cipher_open(&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR, + 0); if (status) { g_error("gcrypt error setting up encryption: %s\n", gcry_strerror(status)); @@ -80,7 +82,7 @@ BlueSkyRCStr *bluesky_crypt_encrypt(BlueSkyRCStr *in, const uint8_t *key) } bluesky_crypt_random_bytes(out, CRYPTO_BLOCK_SIZE); - status = gcry_cipher_setiv(handle, out, CRYPTO_BLOCK_SIZE); + status = gcry_cipher_setctr(handle, out, CRYPTO_BLOCK_SIZE); if (status) { g_error("gcrypt error setting IV: %s\n", gcry_strerror(status)); @@ -106,8 +108,8 @@ BlueSkyRCStr *bluesky_crypt_decrypt(BlueSkyRCStr *in, const uint8_t *key) g_return_val_if_fail(in->len > CRYPTO_BLOCK_SIZE, NULL); - status = gcry_cipher_open(&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CBC, - GCRY_CIPHER_CBC_CTS); + status = gcry_cipher_open(&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_CTR, + 0); if (status) { g_error("gcrypt error setting up encryption: %s\n", gcry_strerror(status)); @@ -121,7 +123,7 @@ BlueSkyRCStr *bluesky_crypt_decrypt(BlueSkyRCStr *in, const uint8_t *key) gcry_strerror(status)); } - status = gcry_cipher_setiv(handle, in->data, CRYPTO_BLOCK_SIZE); + status = gcry_cipher_setctr(handle, in->data, CRYPTO_BLOCK_SIZE); if (status) { g_error("gcrypt error setting IV: %s\n", gcry_strerror(status)); -- 2.20.1