You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When decrypting a 64 bytes buffer using mbedtls_aes_crypt_xts(), only the first 32 bytes seem to be decrypted correctly, whereas, if we chunk the above operation into two decryption operations of 32 bytes each, the result seems to be correct. Below is the test code that could be used to recreate the issue.
System information
Mbed TLS version (number or commit id): mbedtls-3.6.1
Operating system and version: Any
Configuration (if not default, please attach mbedtls_config.h):
Compiler and options (if you used a pre-built binary, please indicate how you obtained it):
Additional environment information:
Expected behavior
Decryption of 64 bytes at once should result in correct decrypted contents
Actual behavior
Decryption of 64 bytes at once, generates correct decryption result only for the first 32 bytes.
A bit of debugging into the issue concluded that the while decrypting the complete 64 bytes buffer the mbedtls_gf128mul_x_ble() function calculates different tweak value for the 3rd block decryption operation after decrypting the first two blocks; as opposed to when decrypting just the second half of the buffer (32 bytes).
The text was updated successfully, but these errors were encountered:
Summary
When decrypting a 64 bytes buffer using
mbedtls_aes_crypt_xts()
, only the first 32 bytes seem to be decrypted correctly, whereas, if we chunk the above operation into two decryption operations of 32 bytes each, the result seems to be correct. Below is the test code that could be used to recreate the issue.System information
Mbed TLS version (number or commit id): mbedtls-3.6.1
Operating system and version: Any
Configuration (if not default, please attach
mbedtls_config.h
):Compiler and options (if you used a pre-built binary, please indicate how you obtained it):
Additional environment information:
Expected behavior
Decryption of 64 bytes at once should result in correct decrypted contents
Actual behavior
Decryption of 64 bytes at once, generates correct decryption result only for the first 32 bytes.
Steps to reproduce
Test code:
Additional information
A bit of debugging into the issue concluded that the while decrypting the complete 64 bytes buffer the
mbedtls_gf128mul_x_ble()
function calculates different tweak value for the 3rd block decryption operation after decrypting the first two blocks; as opposed to when decrypting just the second half of the buffer (32 bytes).The text was updated successfully, but these errors were encountered: