Class: CryptoToolbox::Oracles::CbcMutatingEncryptionOracle

Inherits:
Object
  • Object
show all
Defined in:
lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(key = SecureRandom.random_bytes(16)) ⇒ CbcMutatingEncryptionOracle

Returns a new instance of CbcMutatingEncryptionOracle.



7
8
9
10
11
12
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 7

def initialize(key = SecureRandom.random_bytes(16) )
  @key     = key
  @prefix  = "comment1=cooking%20MCs;userdata="
  @suffix  = ";comment2=%20like%20a%20pound%20of%20bacon"
  @iv      = SecureRandom.random_bytes(16)
end

Instance Attribute Details

#prefix ⇒ Object (readonly)

Returns the value of attribute prefix.



4
5
6
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 4

def prefix
  @prefix
end

#suffix ⇒ Object (readonly)

Returns the value of attribute suffix.



4
5
6
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 4

def suffix
  @suffix
end

Instance Method Details

#encrypted_message_for(user) ⇒ Object 



27
28
29
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 27

def encrypted_message_for(user)
  Ciphers::Aes.new.encipher_cbc(@key,message_for(user),iv: @iv)
end

#is_admin?(ciphertext) ⇒ Boolean

Returns:

  • (Boolean) 


31
32
33
34
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 31

def is_admin?(ciphertext)
  data = decrypt_message(ciphertext)
  data.has_key?(:admin) && data[:admin] == "true"
end

#message_for(user) ⇒ Object

make sure this attack is not possible fake_user=“admin=true;admin=true;” ciphertext = oracle.encrypted_message_for(fake_user) oracle.is_admin?(ciphertext)



18
19
20
21
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 18

def message_for(user)
  user.gsub!(/[;=]/,"") # sanitize meta chars
  @prefix + user + @suffix
end

#parse_message(string) ⇒ Object 



23
24
25
 
# File 'lib/crypto-toolbox/oracles/cbc_mutating_encryption_oracle.rb', line 23

def parse_message(string)
  string.split(";").each_with_object({}){|pair,hsh| k,v = pair.split("="); hsh[k.to_sym] = v }
end