Apple's Common Crypto Library Defaults to a Zero IV if One is not Provided
source link: https://parsiya.net/blog/2014-07-03-apples-common-crypto-library-defaults-to-a-zero-iv-if-one-is-not-provided/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Jul 3, 2014 - 1 minute read - Comments - Crypto
Apple's Common Crypto Library Defaults to a Zero IV if One is not Provided
Today I was writing some guidelines about generating keys for mobile applications at work. While providing code examples in Java and Obj-C for AES encryption I happened to look at Apple's Common Crypto library . While going through the source code for CommonCryptor.c, I noticed that IV is commented as /* optional initialization vector */. This makes sense because not all ciphers use IV and not all AES modes of operation (e.g. ECB mode). However; if an IV is not provided, the library will default to a zero IV.
You can see the code here inside the function ccInitCryptor (search for defaultIV) source. CC_XZEROMEM resets all bytes of IV to zero (that is 0x00):
static inline CCCryptorStatus ccInitCryptor
(CCCryptor *ref, const void *key, unsigned long key_len, const void *tweak_key, const void *iv) {
size_t blocksize = ccGetCipherBlockSize(ref);
uint8_t defaultIV[blocksize];
if(iv == NULL) {
CC_XZEROMEM(defaultIV, blocksize);
iv = defaultIV;
}
...
return kCCSuccess;
}While I am told this is probably common behavior in crypto libraries, I think it's dangerous. I ended up putting a comment in code examples warning developers about this behavior. So, heads up ;)
Posted by Parsia Jul 3, 2014 Tags: Encryption Common Crypto
Piping SSL/TLS Traffic from SoapUI to Burp Fireeye's FLARE Challenge
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK