Commit 02b9104
committed
ZGW-3441: serialapi: Harden SerialAPI_AES128_Encrypt use of rijndael alg
This mitigates a bit use of invalid input data.
Also note rijndaelEncrypt is not returning an 1error on wrong
arguments, this is prone to misuse or malicious attacks.
After more investigations in zipgwateway it looks like
"rijndael-alg-fst.c" was a copy of "Optimised C code v3.0" (under
public domain).
I also note that upstream stated that:
IMPORTANT NOTE ! This code was written in order to clarify the
mathematical description, and to run the statistical test. Without
modification, it should not be used to encrypt files, or for any other
application.
And the downstream changes over that code are minimal.
So we can assume the absent check were done on purpose, since it is
the fast version of the original "Reference code in ANSI C v2.2".
Please refer to related context.
Origin: #36
Bug-SiliconLabs: ZGW-3441
Relate-to: j.s.c/b/UIC-3660
Relate-to: SiliconLabsSoftware/z-wave-protocol-controller-legacy#95
Relate-to: c.s.c/x/MbQ4Jg
Relate-to: SLVDBBP-3113159
Signed-off-by: Philippe Coval <philippe.coval@silabs.com>1 parent d0420b8 commit 02b9104
1 file changed
Lines changed: 10 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
3475 | 3475 | | |
3476 | 3476 | | |
3477 | 3477 | | |
| 3478 | + | |
| 3479 | + | |
| 3480 | + | |
| 3481 | + | |
| 3482 | + | |
| 3483 | + | |
3478 | 3484 | | |
3479 | 3485 | | |
3480 | 3486 | | |
| |||
3483 | 3489 | | |
3484 | 3490 | | |
3485 | 3491 | | |
| 3492 | + | |
| 3493 | + | |
| 3494 | + | |
| 3495 | + | |
3486 | 3496 | | |
3487 | 3497 | | |
3488 | 3498 | | |
| |||
0 commit comments