aws / aws/aws-encryption-sdk-python

deserialize encryption context should fail on malformed encryption context

Ouverte
#57 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
bug good first issue
Langage dominant
Python
Étoiles
255
Forks
92
Merge moyen
2 j 17 h
PR mergées (30 j)
2

Description

If the client deserialization receives a malformed ciphertext that defines the AAD length as 0 and then also defines a AAD fields as 0, the deserialization logic SHOULD raise an error. It does not. Instead, it accidentally interprets it as an empty encryption context.

https://github.com/awslabs/aws-encryption-sdk-python/blob/master/src/aws_encryption_sdk/internal/formatting/encryption_context.py#L159-L164

Example malformed test vector:
```
b'AYAAFJwN8IgQ9+0sxyy7+90cCCgAAgAAAAEAE1dFQi1DUllQVE8tUlNBLU9BRVAAKDhDRUQyRkQyMEZDODhBOUMwNkVGREIwNzM3MDdFQjFFRjE2NTU3ODABAFbIi+gmSrvejfOCjbE08rTYHym2uLWsiizQHnTy3z8/VeR+7MKvNv7ZfPf5LX7i9amYwxCMISvY+BCcndLakH/RlDUdgz5/Q0KAxrE5LX7DHxO/wMviJCi+qXWMb+5u0mhwepRihO/dk+3kGqyaLhnGuA6xqYmThUlCZR5BwfyEddSango7umEWw1YQ8vokjqUzCKRyk3VpXwQTXQLLrBz7ZmZ7Anzn0SoaLYk8D0rPWhKHvUXQDJYDYdQ7vpedxpsE5vliLI98CAcIWllkst964DIBwKgAX6Ic8Nj+8T7VurdK2SFuTH4LIvkebmEGCxngdRpfopEU/Rd0LYXZik4CAAAAAAwAAAAGAAAAAAAAAAAAAAAAK9vNRvymDkoxO6dy67pDuf////8AAAABAAAAAAAAAAAAAAABAAAABTAqmilQragTFTYdPz23w1NMR+c8Uw=='
```

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Inspect src/aws_encryption_sdk/internal/formatting/encryption_context.py at lines 159-164 and reproduce the issue with the malformed ciphertext in the report. Add a regression test for the zero-length AAD and zero-field case, then ensure client deserialization raises an error instead of returning an empty encryption context.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
python
Domaine
cryptography
Type d'issue
Bug
Difficulté
2/5
Temps estimé
1-3 heures
Activité
À l'abandon
Clarté
Clairement spécifiée
Accessibilité débutants
55/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.