Re: CVE Request: static IV used in Percona XtraBackup

[Florian Weimer <fweimer () redhat com>]

On 11/26/2013 07:17 PM, Florian Weimer wrote:
> On 11/26/2013 11:52 AM, Marcus Meissner wrote:
> > Hi,
> >
> > This came to our desk:
> > https://bugzilla.novell.com/show_bug.cgi?id=852224
> > https://bugs.launchpad.net/percona-xtrabackup/+bug/1185343
> >
> > constant IV used in CTR Mode, allowing plaintext retrieval
> > attacks.
>
> Is suppose this is part of the fix.
>
> +void
> +xb_crypt_init_iv()
> +{
> +    uint seed = time(NULL);
> +    srandom(seed);
> +}
> +
> +void
> +xb_crypt_create_iv(void* ivbuf, size_t ivlen)
> +{
> +    size_t i;
> +    ulong rndval;
> +
> +    for (i = 0; i < ivlen; i++) {
> +        if (i % 4 == 0) {
> +            rndval = (ulong) random();
> +        }
> +        ((uchar*)ivbuf)[i] = ((uchar*)&rndval)[i % 4];
> +    }
> +}
>
> This still risks keystream reuse because time() is fairly coarse.
>
> What's worse, on 64-bit big-endian architectures, it results in a
> constant zero IV because RAND_MAX is not large enough to reach the upper
> 32 bits in the first four bytes of the rndval variable.

It appears that both issues have been addressed by the switch to 
libgcrypt for the encryption.

--
Florian Weimer / Red Hat Product Security