I have been seeing errors in the netSNMP 4.2.1 package when using openssl
0.9.6a over LINUX. When I run the same code under W2000 everything
works. On LINUX I get an ASN.1 parse error from SNMP which appears to be
due to erroneous decryption.
I am not using the ASM code on either platform and have turned of
optimizations. I have also stepped through the UCD code in gdb and
DevStudio 6.0.
I have instrumented the UCD code in order to verify that given the same
plaintext, iv and key on both platforms I get different ciphertext. I have
included below the instrumented code and the output from both platforms, I
would appreciate any advice.
I am submitting this question to both projects (netSNMP and OpenSSL).
UCD SNMP 4.2.1 Instrumented Code in scapi.c (line 571)
#ifdef SNMP_TESTING_CODE
{
char buf[SNMP_MAXBUF];
printf("Plaintext length: %d\n", plast);
sprint_hexstring(buf, plaintext, plast);
DEBUGMSGTL(("scapi","encrypt: plaintext: \n%s\n", buf));
sprint_hexstring(buf, key, sizeof(key_struct));
DEBUGMSGTL(("scapi","encrypt: DES Key: \n%s\n", buf));
sprint_hexstring(buf, iv, ivlen);
DEBUGMSGTL(("scapi","encrypt: IV: \n%s\n", buf));
}
#endif
memcpy(key_struct, key, sizeof(key_struct));
(void) des_key_sched(&key_struct, key_sch);
memcpy(my_iv, iv, ivlen);
/* encrypt the data */
des_ncbc_encrypt(plaintext, ciphertext, plast, key_sch,
(des_cblock *) my_iv, DES_ENCRYPT);
if (pad > 0)
{
/* then encrypt the pad block */
des_ncbc_encrypt(pad_block, ciphertext+plast, pad_size,
key_sch, (des_cblock *)my_iv, DES_ENCRYPT);
*ctlen = plast + pad_size;
} else
{
*ctlen = plast;
}
}
sc_encrypt_quit:
printf("In sc_encrypt. pad_size = %d *ctlen = %d\n", pad_size,
*ctlen);
#ifdef SNMP_TESTING_CODE
{
char buf[SNMP_MAXBUF];
printf("Ciphertext length: %d\n", *ctlen);
sprint_hexstring(buf, ciphertext, *ctlen);
DEBUGMSGTL(("scapi","encrypt: ciphertext: \n%s\n", buf));
}
#endif
/* clear memory just in case */
memset(my_iv, 0, sizeof(my_iv));
memset(pad_block, 0, sizeof(pad_block));
memset(key_struct, 0, sizeof(key_struct));
memset(key_sch, 0, sizeof(key_sch));
return rval;
Good Encryption:
scapi: encrypt: plaintext:
30 69 04 10 74 68 69 73 69 73 6D 79 65 6E 67 69
6E 65 69 64 04 10 74 68 69 73 69 73 6D 79 65 6E
67 69 6E 65 69 64 A6 43 02 02 02 00 02 01 00 02
01 00 30 37 30 0D 06 08 2B 06 01 02 01 01 03 00
43 01 63 30 16 06 0A 2B 06 01 06 03 01 01 04 01
00 06 08 2B 06 01 02 01 01 03 00 30 0E 06 08 2B
06 01 02 01 01 03 00 43
trace: E:\ucd-snmp-4.2.1\snmplib\scapi.c, 580
scapi: encrypt: DES Key:
54 BC AA 4D F8 F9 72 2F
trace: E:\ucd-snmp-4.2.1\snmplib\scapi.c, 583
scapi: encrypt: IV:
C9 DB 39 D4 5B 47 F9 ED
In sc_encrypt. pad_size = 8 *ctlen = 112
Ciphertext length: 112
trace: E:\ucd-snmp-4.2.1\snmplib\scapi.c, 612
scapi: encrypt: ciphertext:
C4 91 F9 70 EC CE 09 57 AD F5 22 8F 21 44 83 7E
80 59 9D 13 71 C4 3A 42 38 7A 57 F1 31 0E CA 0F
84 FE AE 64 DB 77 9A A5 A8 0D 22 2F D9 EA 48 DB
DA 55 5A BC B0 B6 6A 15 B1 FC DF 4E 8F 0F 42 28
4D F8 B7 6F BE 84 89 28 64 E0 18 AD D9 7E 90 3F
78 3A 87 D5 BC 1A CF 21 70 14 6F 53 F5 F7 25 A0
11 8A 99 EB B6 46 0D 75 9D 5D C5 3E 66 D2 2D 02
Bad Encryption:
scapi: encrypt: plaintext:
30 69 04 10 74 68 69 73 69 73 6D 79 65 6E 67 69
6E 65 69 64 04 10 74 68 69 73 69 73 6D 79 65 6E
67 69 6E 65 69 64 A6 43 02 02 02 00 02 01 00 02
01 00 30 37 30 0D 06 08 2B 06 01 02 01 01 03 00
43 01 63 30 16 06 0A 2B 06 01 06 03 01 01 04 01
00 06 08 2B 06 01 02 01 01 03 00 30 0E 06 08 2B
06 01 02 01 01 03 00 43
trace: sc_encrypt(): scapi.c, 580
scapi: encrypt: DES Key:
54 BC AA 4D F8 F9 72 2F
trace: sc_encrypt(): scapi.c, 583
scapi: encrypt: IV:
C9 DB 39 D4 5B 47 F9 ED
In sc_encrypt. pad_size = 8 *ctlen = 112
Ciphertext length: 112
trace: sc_encrypt(): scapi.c, 612
scapi: encrypt: ciphertext:
04 D8 7E 16 6D 79 BA F7 B6 62 9F E6 0F 8A 23 6B
32 65 55 49 A1 E0 B1 88 83 DB 73 65 07 6E E7 15
A8 50 C0 AD C9 A4 43 BB 23 D5 6C 82 CA C2 80 37
45 3D 41 50 93 BC 8E A7 8E 45 7B 73 77 83 B7 2C
88 D1 A3 85 CD 77 29 23 A9 3E 89 38 D4 67 C8 E5
A7 B6 6C 33 C0 72 3E 02 3C 0C B3 E5 0A 5F 1A 05
4A 95 90 26 39 83 32 1B 45 62 97 8D AA 48 46 D4
Peter Grossman 978-244-8315 Fax 978-244-8917
Cisco Systems, Inc. [EMAIL PROTECTED]
300 Apollo Drive Chelmsford, MA 01824
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
