kfogel / OneTime

An open source encryption program that uses the "one-time pad" method.
http://red-bean.com/onetime
32 stars 14 forks source link

detect any tampering with the ciphertext #25

Open aaannndddyyy opened 7 years ago

aaannndddyyy commented 7 years ago

Detect any tampering with the ciphertext, or rahter with the entire content of the .onetime file.

1) If I remove the empty line after the offset indication and before the encrypted part, onetime does not complain upon decryption, but it decrypts to an empty file. Expected result: raise an error. the more verbose the better, so that it could be repaired. In this case it was a copy paste error and not malign tampering. After re-adding the free line, the original text was recovered and of course, digest matched.

2) I can even change a few bytes in the beginning, probably still before Head Fuzz, without affecting the result of the decryption. It is fortunate that the message is not lost, but unfortunate that the user is not informed about a possible modification attempt