[BUG] Failure in decryption of TO2 message due to missing of AAD while encryption

[Sai-Anudeep47]

To simplify issue resolution process, please provide network logs, and or test voucher. to2_msg65_decrypt_fail_add_log.txt

What part of the spec are you testing?

• [ ] Rendezvous Server
• [ ] Device Onboarding Service
• [x] Device Implementation

What protocol are having issue with?

• [ ] TO0
• [ ] TO1
• [x] TO2

Issue description

• Decryption of message 65 failed on client side using AES256GCM cipher suite due to authentication failure
• According to https://www.rfc-editor.org/rfc/rfc8152#section-5.3, for AEAD algorithms, authenticated data structure (context, protected header, external_aad) has to be used while encryption and decryption.
• According to https://pkg.go.dev/crypto/cipher#NewGCM, additionalData to be passed for Seal function for AEAD algorithms, but observed, it is missing in https://github.com/fido-alliance/fdo-fido-conformance-server/blob/main/core/shared/enc.crypto.go#L405

[yackermann]

Working on it. New build tomorrow.

[yackermann]

Addressed

[GeofCooper]

We traced the requirement that the AAD IV cannot be zero, or any predictable value: See reference to:

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf

8. Uniqueness Requirement on IVs and Keys

The IVs in GCM must fulfill the following “uniqueness” requirement:
The probability that the authenticated encryption function ever will be invoked with the
same IV and the same key on two (or more) distinct sets of input data shall be no greater
than 2-32.

Compliance with this requirement is crucial to the security of GCM. Across all instances of the
authenticated encryption function with a given key, if even one IV is ever repeated, then the
implementation may be vulnerable to the forgery attacks that are described in Ref [5] and
summarized in Appendix A. In practice, this requirement is almost as important as the secrecy
of the key. 

This document is referenced as authoritative by IETF, and is also referenced in the FDO specification.

[GeofCooper]

Reopening, we don't think this is addressed yet, if you do, please provide more evidence.