Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-21 20:23:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

Update cipher-block-chaining-cbc-mac-priv.md

Browse source 
The final signature should be the last signature of m3 which is S32, as it is already including S31 in it (remember when we did `rator\00\00\00 XOR s1`). Plus we can't concatenate two s1 and s32 to make the signature of administrator because this will be two block size!
This commit is contained in:
Mohammed Alshaboti 2022-03-28 11:07:02 +13:00 committed by GitHub
parent f2df90bf81
commit 03555f03c4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
cryptography/cipher-block-chaining-cbc-mac-priv.md
View file

@ -32,15 +32,15 @@ Imagine you are encrypting the name **Administrator** in **8bytes** blocks:
* `Administ`
* `rator\00\00\00`
You can create a username called **Administ** (m1) and retrieve the key (s1).\
You can create a username called **Administ** (m1) and retrieve the signature (s1).\
Then, you can create a username called the result of `rator\00\00\00 XOR s1`. This will generate `E(m2 XOR s1 XOR 0)` which is s32.\
now, knowing s1 and s32 you can put them together an generate the encryption of the full name **Administrator**.
now, you can use s32 as the singature of the full name **Administrator**.
#### Summary
1. Get the signature of username **Administ** (m1) which is s1
2. Get the signature of username **rator\x00\x00\x00 XOR s1 XOR 0** is s32**.**
3. Set the cookie to s1 followed by s32 and it will be a valid cookie for the user **Administrator**.
3. Set the cookie to s32 and it will be a valid cookie for the user **Administrator**.
## Attack Controlling IV