From be05fbdd539789e97fec32ce49d33c7a7c641869 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Wed, 25 Mar 2026 13:53:11 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix:=20Replace=20unauthenticated?= =?UTF-8?q?=20AES-CBC=20with=20AES-GCM?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaced the unauthenticated AES-CBC encryption mode with the authenticated AES-GCM mode in UserManager.cs to provide both confidentiality and integrity. Updated hardcoded credentials and call sites accordingly. Co-authored-by: LDzik <63643405+LDzik@users.noreply.github.com> --- LWCredentialProvider/CredentialProvider.cs | 14 ++--- LWCredentialProvider/Tile.cs | 14 ++--- LWCredentialProvider/UserManager.cs | 66 +++++++++++----------- 3 files changed, 48 insertions(+), 46 deletions(-) diff --git a/LWCredentialProvider/CredentialProvider.cs b/LWCredentialProvider/CredentialProvider.cs index df03bbb..43a4261 100644 --- a/LWCredentialProvider/CredentialProvider.cs +++ b/LWCredentialProvider/CredentialProvider.cs @@ -179,13 +179,13 @@ private object[] IsUsbDeviceConnected() - string data = "6603691B6B7EE37F3CA4195BC605F3BAB777457F43F91EB65CEFDCCAB07D070E"; + string data = "D1AEF672E35561979417C5FEADD24295D94B6F35478517DAB8017ABC894D53C1"; string key = "36DB0D6DAC8388994EF40DE6E5A32D9EE1DDBEE7C8D17C6D7D345CABBC5CA15C"; - string iv = "DD25843EB39A529F3FC235BC7C60B997"; + string nonce = "B5873E93745D34937776C2CE"; UserManager userManager = new UserManager(); - string userData = userManager.DecodeData(data, key, iv); + string userData = userManager.DecodeData(data, key, nonce); string[] parts = userData.Split(new[] { UserManager.Separator }, StringSplitOptions.None); @@ -231,17 +231,17 @@ private string DriveTesting() // string username = "admin"; // string password = "zaq1@WSX"; - string data = "6603691B6B7EE37F3CA4195BC605F3BAB777457F43F91EB65CEFDCCAB07D070E"; + string data = "D1AEF672E35561979417C5FEADD24295D94B6F35478517DAB8017ABC894D53C1"; string key = "36DB0D6DAC8388994EF40DE6E5A32D9EE1DDBEE7C8D17C6D7D345CABBC5CA15C"; - string iv = "DD25843EB39A529F3FC235BC7C60B997"; + string nonce = "B5873E93745D34937776C2CE"; UserManager userManager = new UserManager(); - string userData = userManager.DecodeData(data, key, iv); + string userData = userManager.DecodeData(data, key, nonce); // return userData; - // string userDataHex = userManager.EncodeData(username, password, key, iv); + // string userDataHex = userManager.EncodeData(username, password, key, nonce); // Console.WriteLine($"userDataHex: {userDataHex}"); diff --git a/LWCredentialProvider/Tile.cs b/LWCredentialProvider/Tile.cs index 0903645..748aac3 100644 --- a/LWCredentialProvider/Tile.cs +++ b/LWCredentialProvider/Tile.cs @@ -90,13 +90,13 @@ -// string data = "6603691B6B7EE37F3CA4195BC605F3BAB777457F43F91EB65CEFDCCAB07D070E"; +// string data = "D1AEF672E35561979417C5FEADD24295D94B6F35478517DAB8017ABC894D53C1"; // string key = "36DB0D6DAC8388994EF40DE6E5A32D9EE1DDBEE7C8D17C6D7D345CABBC5CA15C"; -// string iv = "DD25843EB39A529F3FC235BC7C60B997"; +// string nonce = "B5873E93745D34937776C2CE"; // UserManager userManager = new UserManager(); -// string userData = userManager.DecodeData(data, key, iv); +// string userData = userManager.DecodeData(data, key, nonce); // string[] parts = userData.Split(new[] { UserManager.Separator }, StringSplitOptions.None); @@ -142,17 +142,17 @@ // // string username = "admin"; // // string password = "zaq1@WSX"; -// string data = "6603691B6B7EE37F3CA4195BC605F3BAB777457F43F91EB65CEFDCCAB07D070E"; +// string data = "D1AEF672E35561979417C5FEADD24295D94B6F35478517DAB8017ABC894D53C1"; // string key = "36DB0D6DAC8388994EF40DE6E5A32D9EE1DDBEE7C8D17C6D7D345CABBC5CA15C"; -// string iv = "DD25843EB39A529F3FC235BC7C60B997"; +// string nonce = "B5873E93745D34937776C2CE"; // UserManager userManager = new UserManager(); -// string userData = userManager.DecodeData(data, key, iv); +// string userData = userManager.DecodeData(data, key, nonce); // // return userData; -// // string userDataHex = userManager.EncodeData(username, password, key, iv); +// // string userDataHex = userManager.EncodeData(username, password, key, nonce); // // Console.WriteLine($"userDataHex: {userDataHex}"); diff --git a/LWCredentialProvider/UserManager.cs b/LWCredentialProvider/UserManager.cs index a4f7fbd..a19a906 100644 --- a/LWCredentialProvider/UserManager.cs +++ b/LWCredentialProvider/UserManager.cs @@ -9,34 +9,42 @@ public class UserManager { public const string Separator = "\u2561"; - public string DecodeData(string encodedDataHex, string keyHex, string ivHex) + public string DecodeData(string encodedDataHex, string keyHex, string nonceHex) { if (string.IsNullOrEmpty(encodedDataHex)) return ""; byte[] encodedData = HexStringToByteArray(encodedDataHex); byte[] key = HexStringToByteArray(keyHex); - byte[] iv = HexStringToByteArray(ivHex); + byte[] nonce = HexStringToByteArray(nonceHex); - using Aes aes = Aes.Create(); - aes.Key = key; - aes.IV = iv; - aes.Padding = PaddingMode.PKCS7; + // Assuming tag size of 16 bytes and it's appended to ciphertext + int tagSize = 16; + if (encodedData.Length < tagSize) + { + throw new ArgumentException("Invalid encoded data length."); + } + + int ciphertextSize = encodedData.Length - tagSize; + + byte[] ciphertext = new byte[ciphertextSize]; + byte[] tag = new byte[tagSize]; + + Array.Copy(encodedData, 0, ciphertext, 0, ciphertextSize); + Array.Copy(encodedData, ciphertextSize, tag, 0, tagSize); - using var decryptor = aes.CreateDecryptor(aes.Key, aes.IV); - string decryptedText; - using (var msDecrypt = new MemoryStream(encodedData)) + byte[] plaintextBytes = new byte[ciphertextSize]; + + using (AesGcm aesGcm = new AesGcm(key, tagSize)) { - using var csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read); - using var srDecrypt = new StreamReader(csDecrypt, Encoding.UTF8, true); - decryptedText = srDecrypt.ReadToEnd(); + aesGcm.Decrypt(nonce, ciphertext, tag, plaintextBytes); } - return decryptedText; + return Encoding.UTF8.GetString(plaintextBytes); } - public string EncodeData(string username, string password, string keyHex, string ivHex) + public string EncodeData(string username, string password, string keyHex, string nonceHex) { if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password)) return ""; @@ -44,28 +52,23 @@ public string EncodeData(string username, string password, string keyHex, string string dataText = username + Separator + password; byte[] key = HexStringToByteArray(keyHex); - byte[] iv = HexStringToByteArray(ivHex); - byte[] dataBytes = Encoding.UTF8.GetBytes(dataText); - - using Aes aes = Aes.Create(); - aes.Key = key; - aes.IV = iv; - aes.Padding = PaddingMode.PKCS7; + byte[] nonce = HexStringToByteArray(nonceHex); + byte[] plaintextBytes = Encoding.UTF8.GetBytes(dataText); - using var encryptor = aes.CreateEncryptor(aes.Key, aes.IV); - byte[] encryptedBytes; + int tagSize = 16; + byte[] ciphertext = new byte[plaintextBytes.Length]; + byte[] tag = new byte[tagSize]; - using (var msEncrypt = new MemoryStream()) + using (AesGcm aesGcm = new AesGcm(key, tagSize)) { - using (var csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write)) - { - csEncrypt.Write(dataBytes, 0, dataBytes.Length); - csEncrypt.FlushFinalBlock(); - } - encryptedBytes = msEncrypt.ToArray(); + aesGcm.Encrypt(nonce, plaintextBytes, ciphertext, tag); } - return BitConverter.ToString(encryptedBytes).Replace("-", ""); + byte[] result = new byte[ciphertext.Length + tag.Length]; + Array.Copy(ciphertext, 0, result, 0, ciphertext.Length); + Array.Copy(tag, 0, result, ciphertext.Length, tag.Length); + + return BitConverter.ToString(result).Replace("-", ""); } private byte[] HexStringToByteArray(string hex) @@ -77,4 +80,3 @@ private byte[] HexStringToByteArray(string hex) } } // } -