Bug report: CMAC doesn't assume hex-only input as hex
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the bug**
When I use CyberChef for various encryption schemes, it seems to accurately calculate results when compared to several other calculators. Utilizing CMAC, it does not generate the correct output. The issue appears to be that CMAC doesn't seem to assume hex encoding of input, whereas other schemes do.
**To Reproduce**
Steps to reproduce the behaviour or a link to the recipe / input used to cause the bug:
(https://gchq.github.io/CyberChef/#recipe=CMAC(%7B'option':'Hex','string':'ff9f9284cf599eac3b119905a7d18851e7e374cf63aea04358586b0f757670f9'%7D,'AES')&input=MDJDMDAwMDAxODAwMDAwQzA4MDEwMDAwMDAwRjAwMTEyMjMzNDQ1NTY2Nzc4ODk5QUFCQkNDRERFRUZG)
**Expected behaviour**
I would expect, having worked with AES-GCM that I would not need to add a 'from_hex' to the recipe:
(https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')CMAC(%7B'option':'Hex','string':'ff9f9284cf599eac3b119905a7d18851e7e374cf63aea04358586b0f757670f9'%7D,'AES')&input=MDJDMDAwMDAxODAwMDAwQzA4MDEwMDAwMDAwRjAwMTEyMjMzNDQ1NTY2Nzc4ODk5QUFCQkNDRERFRUZG)
The output from this link matches pycryptodome and CryptoJS, as well as libgcrypt.
**Additional context**
It just seems an inconsistency given other schemes. Sometimes in large Unit Tests I'll include a single CyberChef link for others to examine as a sanity check, or as an external validation of code I'm writing. In this instance my code wasn't matching cyberchef, and based on assumptions made due to previous usage, I thought my code was wrong.
Edit: Wrong Expected Behavior Link
Contributor guide
Research direction
Start with the linked CyberChef CMAC recipe and compare its result with the variant that applies From_Hex('Auto') first. Check the CMAC operation's handling of the hex-only input, then compare the result with pycryptodome, CryptoJS, or libgcrypt; done means the behavior is consistent with the expected reference output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100