When doing MBEDTLS_CIPHER_AES_128_CBC decryption with a zeroed key, output is set to a random number

[andre-rosa]

Summary

Even thought mbedtls returns an error if there's invalid padding, the output parameter was being set instead of leaving it with zero. This check exists in openssl, so this makes the behavior closer between both libraries.

• mbedtls:

  • mbedtls/library/cipher.c

    Line 852 in 489688c

    *data_len = input_len - padding_len;

• openssl:
  • https://github.com/openssl/openssl/blob/1848c561ec39a9ea91ff1bf740a554be274f98b0/crypto/evp/evp_enc.c#L1023
  • openssl/openssl@b554eef

System information

Mbed TLS version (number or commit id): 3.6
Operating system and version: Linux
Configuration (if not default, please attach mbedtls_config.h): default
Compiler and options (if you used a pre-built binary, please indicate how you obtained it): default
Additional environment information: N/A

Expected behavior

In case of error, output should contain zero.

Actual behavior

In case of error, output may contain some random number like 18446744073709551516.

Steps to reproduce

Trying to decrypt AES 128 CBR with a zeroed key and MBEDTLS_PADDING_PKCS7 padding enabled.

Additional information

Please see the related PR: #9082 (development), #9132 (3.6 backport).

[andre-rosa]

Hi @tgonzalezorlandoarm, is it possible to add another reviewer to #9082, please? Many thanks for considering my request.