From 39f5e1fae87bf9dcf81f0b212c1aede28b262769 Mon Sep 17 00:00:00 2001 From: Karel Miko Date: Sat, 18 Jul 2026 17:32:18 +0200 Subject: [PATCH] EAX properly handle taglen boundaries --- doc/crypt.tex | 4 ++++ src/encauth/eax/eax_decrypt_verify_memory.c | 9 +++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/doc/crypt.tex b/doc/crypt.tex index 22e1337fe..fbe9098cc 100644 --- a/doc/crypt.tex +++ b/doc/crypt.tex @@ -1867,6 +1867,10 @@ \chapter{Authenticated Encryption} The only difference is eax\_decrypt\_verify\_memory() does not emit a tag. Instead you pass it a tag as input and it compares it against the tag it computed while decrypting the message. If the tags match then it stores a $1$ in \textit{res}, otherwise it stores a $0$. +The length of the tag is a security parameter of EAX mode: tags may be truncated and a zerolength tag is legal -- it simply +provides no authenticity, which is the caller's choice. A \textit{taglen} larger than the block size of the used cipher is rejected +by eax\_decrypt\_verify\_memory() with \textbf{CRYPT\_INVALID\_ARG} (encrypt side can never emit such a tag). + \mysection{OCB Mode} \subsection{Preface} diff --git a/src/encauth/eax/eax_decrypt_verify_memory.c b/src/encauth/eax/eax_decrypt_verify_memory.c index 5429d4aed..e00233b38 100644 --- a/src/encauth/eax/eax_decrypt_verify_memory.c +++ b/src/encauth/eax/eax_decrypt_verify_memory.c @@ -49,8 +49,13 @@ int eax_decrypt_verify_memory(int cipher, /* default to zero */ *stat = 0; - /* limit taglen */ - taglen = MIN(taglen, MAXBLOCKSIZE); + if ((err = cipher_is_valid(cipher)) != CRYPT_OK) { + return err; + } + /* NOTE: zero-length tag is legal (it just provides no authenticity) */ + if (taglen > (unsigned long)cipher_descriptor[cipher].block_length) { + return CRYPT_INVALID_ARG; + } /* allocate ram */ buf = XMALLOC(taglen);