# Cryptography Bug Sample Analysis [TOC] ## About This document reports the cryptographic vulnerabilities in the given code. We analyse possible ways this code can obsure the security as well as provide solutions in mitigating it. ![](https://i.imgur.com/vjIyFXV.png) ## Vulnerabilities ### Passing file path from Command Line Interface(CLI) * Name: Command Injection Attack * Description: The code snippet reads file path from the command line. Vulnerable to command line injection attack ``` parser.add_argument('input_file_path', help="Path to file to be decrypted.") ``` ### Passing sensitive Data from Command Line Interface(CLI) * Name: Command Injection Attack * Description: Passing sensitive parameters from CLI could led to its hijacking because OS processes can be monitored Code Section: ``` parser.add_argument('password', help="Password used to encrypt file.") ``` ### HKDF Vulnerabilties The keying material (here 'password') is taken from CLI, making it the most vulnerable aspect of HKDF. Passwords from CLI can be hijacked by process monitoring tools . The salt used in hkdf is a user input data. In addition to that its not random. The security of keys derived from HKDF is in the entropy provided by the salt. ``` key = hkdf(inputsargs. password, salt=args.name, algorithm="SHA256") ``` ### Overflow Attacks In this code, the length of the key derived is not defined. Even for input passwords no length is specified. This may lead to stack overflow attack. ### AES-CTR 1. If the same 'password' is used the hkdf would generate same key for multiple encryptions since 'salt' is not random. It is possible that keys can be static for the above hkdf output hence it could leak information . 2. AES - CTR must be used with an approriate authentication scheme as it is velnerable to chosen cipher text attack. In this code there is no authentication scheme. `plaintext = decrypt(ciphertext, key, algorithm="AES-CTR")` ### Return-Statement The return statement exceptions shoyld be handled by adding an exception handler : try-finally block . # Previous Works ## Implementation ### Trusted Platform Module for Identity Management: https://github.com/lucy-sha512/tpm-core ### Security keys (PIV) https://github.com/UNIRIS/yubikey-core ### Biometrics and Cryptoprocessor https://github.com/UNIRIS/yubikey-core ## Research ### Analysis of Crystals-Dilithium for Blockchain security https://ieeexplore.ieee.org/document/9478087