search

bcgit / pc-dart

Pointy Castle - Dart Derived Bouncy Castle APIs
MIT License
241 stars 125 forks source link

AES/GCM/PKCS7 doesn't include authentication tag #238

Open MatthewLM opened 5 months ago

MatthewLM commented 5 months ago

When using AES/GCM/PKCS7 the authentication tag is not included in the encrypted output. This is because PaddedBlockCipherImpl does not call doFinal of GCMBlockCipher.

This means AES/GCM/PKCS7 is not authenticated and presents a severe security vulnerability.