You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The algorithm internally uses UTF-16 strings and XORs a refilling 32-byte buffer of characters with the internal state of what looks to be part of AES-256. The code is pretty short, go read it for more info. Open a pull request if you can figure out a way to simplify it.
42
+
# Example
43
+
44
+
$ eac_logchecker logs/01.log
45
+
Log Integrity Checker (C) 2010 by Andre Wiethoff
46
+
47
+
1. Log entry is fine!
48
+
$ eac_logchecker logs/01.log
49
+
$ eac_logchecker logs/05.log
50
+
Log Integrity Checker (C) 2010 by Andre Wiethoff
51
+
52
+
1. Log entry is fine!
53
+
2. Log entry is fine!
54
+
$ eac_logchecker --json logs/05.log
55
+
[{"message": "Log entry is fine!", "status": "OK"}, {"message": "Log entry is fine!", "status": "OK"}]
56
+
57
+
# Algorithm
58
+
59
+
1. Strip the log file of newlines and BOMs.
60
+
2. Cut off the existing signature block and (re-)encode the log text back into little-endian UTF-16
61
+
3. Encrypt the log file with Rijndael-256:
62
+
- in CBC mode
63
+
- with a 256-bit block size (most AES implementations hard-code a 128-bit block size)
64
+
- all-zeroes IV
65
+
- zero-padding
66
+
- the hex key `9378716cf13e4265ae55338e940b376184da389e50647726b35f6f341ee3efd9`
67
+
4. XOR together all of the resulting 256-bit ciphertext blocks. You can do it byte-by-byte, it doesn't matter in the end.
68
+
5. Output the little-endian representation of the above number, in uppercase hex.
0 commit comments