@@ -405,7 +405,13 @@
{
static const char error_prefix[] = "AEAD Decrypt error";
struct packet_id_net pin = { 0 };
- const struct key_ctx *ctx = &opt->key_ctx_bi.decrypt;
+ struct key_ctx *ctx = &opt->key_ctx_bi.decrypt;
+
+ if (cipher_decrypt_verify_fail_exceeded(ctx))
+ {
+ CRYPT_DROP("Decryption failed verification limit reached.");
+ }
+
int outlen;
struct gc_arena gc;
@@ -511,6 +517,7 @@
if (!cipher_ctx_final_check_tag(ctx->cipher, BPTR(&work) + outlen,
&outlen, tag_ptr, tag_size))
{
+ ctx->failed_verifications++;
CRYPT_DROP("packet tag authentication failed");
}
ASSERT(buf_inc_len(&work, outlen));
@@ -209,6 +209,8 @@
* with the current key in number of 128 bit blocks (only used for
* AEAD ciphers) */
uint64_t plaintext_blocks;
+ /** number of failed verification using this cipher */
+ uint64_t failed_verifications;
};
#define KEY_DIRECTION_BIDIRECTIONAL 0 /* same keys for both directions */
@@ -661,6 +663,32 @@
cipher_get_aead_limits(const char *ciphername);
/**
+ * Check if the number of failed decryption is over the acceptable limit.
+ */
+static inline bool
+cipher_decrypt_verify_fail_exceeded(const struct key_ctx *ctx)
+{
+ /* Use 2**36, same as DTLS 1.3. Strictly speaking this only guarantees
+ * the security margin for packets up to 2^10 blocks (16384 bytes)
+ * but we accept slightly lower security bound for the edge
+ * of Chacha20-Poly1305 and packets over 16k as MTUs over 16k are
+ * extremely rarely used */
+ return ctx->failed_verifications > (1ull << 36);
+}
+
+/**
+ * Check if the number of failed decryption is approaching the limit and we
+ * should try to move to a new key
+ */
+static inline bool
+cipher_decrypt_verify_fail_warn(const struct key_ctx *ctx)
+{
+ /* Use 2**35, half the amount after which we refuse to decrypt */
+ return ctx->failed_verifications > (1ull << 35);
+}
+
+
+/**
* Blocksize used for the AEAD limit caluclation
*
* Since cipher_ctx_block_size() is not reliable and will return 1 in many
@@ -3005,6 +3005,11 @@
return true;
}
+ if (cipher_decrypt_verify_fail_warn(&key_ctx_bi->decrypt))
+ {
+ return true;
+ }
+
return false;
}
/*