bcgit / pc-dart

Pointy Castle - Dart Derived Bouncy Castle APIs
MIT License
230 stars 121 forks source link

AES/GCM/PKCS7 doesn't include authentication tag #238

Open MatthewLM opened 1 month ago

MatthewLM commented 1 month ago

When using AES/GCM/PKCS7 the authentication tag is not included in the encrypted output. This is because PaddedBlockCipherImpl does not call doFinal of GCMBlockCipher.

This means AES/GCM/PKCS7 is not authenticated and presents a severe security vulnerability.