aws / aws/aws-encryption-sdk-python
deserialize encryption context should fail on malformed encryption context
- 主要语言
- Python
- 星标
- 255
- 派生
- 92
- 平均合并
- 2 天 17 小时
- 30 天内合并 PR
- 2
描述
If the client deserialization receives a malformed ciphertext that defines the AAD length as 0 and then also defines a AAD fields as 0, the deserialization logic SHOULD raise an error. It does not. Instead, it accidentally interprets it as an empty encryption context.
https://github.com/awslabs/aws-encryption-sdk-python/blob/master/src/aws_encryption_sdk/internal/formatting/encryption_context.py#L159-L164
Example malformed test vector:
```
b'AYAAFJwN8IgQ9+0sxyy7+90cCCgAAgAAAAEAE1dFQi1DUllQVE8tUlNBLU9BRVAAKDhDRUQyRkQyMEZDODhBOUMwNkVGREIwNzM3MDdFQjFFRjE2NTU3ODABAFbIi+gmSrvejfOCjbE08rTYHym2uLWsiizQHnTy3z8/VeR+7MKvNv7ZfPf5LX7i9amYwxCMISvY+BCcndLakH/RlDUdgz5/Q0KAxrE5LX7DHxO/wMviJCi+qXWMb+5u0mhwepRihO/dk+3kGqyaLhnGuA6xqYmThUlCZR5BwfyEddSango7umEWw1YQ8vokjqUzCKRyk3VpXwQTXQLLrBz7ZmZ7Anzn0SoaLYk8D0rPWhKHvUXQDJYDYdQ7vpedxpsE5vliLI98CAcIWllkst964DIBwKgAX6Ic8Nj+8T7VurdK2SFuTH4LIvkebmEGCxngdRpfopEU/Rd0LYXZik4CAAAAAAwAAAAGAAAAAAAAAAAAAAAAK9vNRvymDkoxO6dy67pDuf////8AAAABAAAAAAAAAAAAAAABAAAABTAqmilQragTFTYdPz23w1NMR+c8Uw=='
```
贡献指南
调研方向
检查 src/aws_encryption_sdk/internal/formatting/encryption_context.py 的第 159-164 行,并使用报告中的格式错误 ciphertext 重现该问题。为 AAD 长度为零且字段数为零的情况添加回归测试,然后确保客户端反序列化时抛出错误,而不是返回空的加密上下文。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- cryptography
- Issue 类型
- 缺陷
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 55/100