dorssel / dotnet-aes-extra

.NET Standard 2.0 implementation of AES-CTR, AES-CMAC, and SIV-AES (aka AES-SIV).

dotnet-aes-extra

.NET Standard 2.0 implementation of the following AES modes that are not included in .NET 6.0 / .NET Framework:

• AES-CTR, as defined by NIST SP 800-38A
• AES-CMAC, as defined by NIST SP 800-38B
• SIV-AES, as defined by RFC 5297
  (Note: this is often refered to as AES-SIV, but the original RFC specification uses the name SIV-AES)

The implementation is for AnyCPU, and works on all platforms.

Usage

The released binary NuGet packages and the .NET assemblies contained therein:

• use Strong Naming,
• include SourceLink,
• include IntelliSense compatible documentation, and
• are signed and timestamped with Authenticode.

All public classes are in the Dorssel.Security.Cryptography namespace.

• AesCtr is modeled after .NET's Aes. So, instead of Aes.Create(), use AesCtr.Create().
• AesCmac is modeled after .NET's HMACSHA256. So, instead of new HMACSHA256(key), use new AesCmac(key).
• AesSiv is modeled after .NET's AesGcm. So, instead of new AesGcm(key), use new AesSiv(key).

dotnet-aes-extra's Issues

AES-SIV tag comparison should be constant time

Hi @dorssel,

That's a nice looking library!

I believe the AES-SIV tag comparison:

dotnet-aes-extra/AesExtra/AesSiv.cs

Line 181 in eb6da59

if (!Enumerable.SequenceEqual(T, V))

should be changed to a method that is guaranteed to be constant time.
Otherwise, an attacker may be able to easily forge a valid tag.

If this is difficult in .NET, it may be enough to simply do a second comparison to a tag calculated with a random (freshly generated every time) key.

Also, it appears there is a debug message left in, here:

dotnet-aes-extra/AesExtra/AesSiv.cs

Line 129 in eb6da59

Console.WriteLine("Bingo");