AEAD Decryption with OpenSSL in C - c

Question

I have the following code to decrypt some AEAD encrypted password:
int aead_decrypt(char *cipher_password, int len_cipher_password, char *tag, char *key, char *iv, int len_iv, char **plaintext_password) {
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
// Cipher_password len always greater or equal to plaintext
*plaintext_password = (unsigned char *)malloc(len_cipher_password);
if(*plaintext_password == 0) {
fprintf(stderr, "malloc() failure\n");
free(*plaintext_password);
return -1;
}
if(!(ctx = EVP_CIPHER_CTX_new())) {
fprintf(stderr, "EVP_CIPHER_CTX_new() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL)) {
fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) {
fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(!EVP_DecryptUpdate(ctx, *plaintext_password, &len, cipher_password, len_cipher_password)) {
//if(!EVP_DecryptUpdate(ctx, *plaintext_password, &len, padded_cipher_password, len_padded_cipher_password)) {
fprintf(stderr, "EVP_DecryptUpdate() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(1!=EVP_DecryptFinal_ex(ctx, *plaintext_password+len, &len)) {
fprintf(stderr, "EVP_DecryptFinal_ex() failure\n");
ERR_print_errors_fp(stderr);
ERR_print_errors_fp(stdout);
return -1;
}
plaintext_len += len;
(*plaintext_password)[plaintext_len] = '\0';
EVP_CIPHER_CTX_free(ctx);
return 1;
}
My problem is that the EVP_DecryptFinal_ex() function always fail but without printing any errors.
My plaintext_password comes out decrypted but with 16 bytes of garbage at the end because the EVP_DecryptUpdate() function doesn't return the good plaintext_password_len.
I thought at first it was because of padding, my cipher_password is often 24-25 bytes long, so i tried adding some as we can see in the different comments but it did not worked out.
(Also i know i pass some parameters i don't use but that's not what's important here).
I don't know where the problem could be and i'm not that familiar with the OpenSSL library.

Answer 1

Got it, i was actually confusing aad and tag values. In Authenticated encryption the tag value is always generated (can't be null). In my example it was the default size: 16 bytes. Tag value is then appended to the cipher data. You can use it to authenticate your decrypted data.
Here is my fixed code:
int aead_decrypt(char *cipher_password, int len_cipher_password, char *key, char *iv, int len_iv, char **plaintext_password) {
EVP_CIPHER_CTX *ctx;
int len;
int plaintext_len;
// The tag is appended at the end of the cipher data
int tag_offset = len_cipher_password-16;
// Cipher_password len always greater or equal to plaintext
*plaintext_password = (unsigned char *)malloc(len_cipher_password);
if(*plaintext_password == 0) {
fprintf(stderr, "malloc() failure\n");
free(*plaintext_password);
return -1;
}
if(!(ctx = EVP_CIPHER_CTX_new())) {
fprintf(stderr, "EVP_CIPHER_CTX_new() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(!EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL)) {
fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(!EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv)) {
fprintf(stderr, "EVP_DecryptInit_ex() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
// Set the expected tag value for authenticated data
if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, cipher_password+tag_offset)) {
fprintf(stderr, "EVP_CIPHER_CTX_ctrl() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
if(!EVP_DecryptUpdate(ctx, *plaintext_password, &len, cipher_password, tag_offset)) {
fprintf(stderr, "EVP_DecryptUpdate() failure\n");
ERR_print_errors_fp(stderr);
return -1;
}
plaintext_len = len;
if(1!=EVP_DecryptFinal_ex(ctx, *plaintext_password+len, &len)) {
fprintf(stderr, "EVP_DecryptFinal_ex() failure\n");
ERR_print_errors_fp(stderr);
ERR_print_errors_fp(stdout);
}
plaintext_len += len;
(*plaintext_password)[plaintext_len] = '\0';
EVP_CIPHER_CTX_free(ctx);
return 1;}