4

Let's say we have a message that is signed with an HMAC, then that message and the HMAC are encrypted, then that is sent over a TCP socket:

// endpoint info excluded
TcpClient client = new TcpClient();
var stream = client.GetStream();

// assume pre-shared keys are used and set at this point
AesManaged aes = new AesManaged();
var aesEncryptor = aes.CreateEncryptor();
CryptoStream aesStream = new CryptoStream(
    stream, aesEncryptor, CryptoStreamMode.Write);

// assume pre-shared keys here too
HMACSHA256 mac = new HMACSHA256();
CryptoStream macStream = new CryptoStream(
    aesStream, mac, CryptoStreamMode.Write);

// assume a message with actual data is written to the macStream
// which updates the hash of the HMAC and also pipes the message
// to the aesStream which encrypts the data and writes it to the
// TCP socket stream
byte[] message = new byte[1024];
macStream.Write(message, 0, message.Length);
macStream.FlushFinalBlock();

// flushing the final block of the macStream actually flushes the
// final block of the aesStream, so I get an error when trying to
// write the HMAC hash to the aesStream
aesStream.Write(mac.Hash, 0, mac.Hash.Length);
aesStream.FlushFinalBlock();

I abstracted out a lot of the code, so this isn't a working example. I could probably work around this my writing the data twice, once to HMAC.TransformBlock and again to the aesStream, but I'd like to avoid that. Any ideas?

3 Answers 3

4

Since I'm dealing with similar topics atm, I'll put an answer here:

Like Maarten Bodewes wrote, I suggest you do encrypt-then-MAC.

You could then write the HMAC-Bytes after doing FlushFinalBlock() on the aesStream.

Don't forget to dispose the CryptoStreams and Algorithms objects!

var stream = client.GetStream();

HMACSHA256 mac = new HMACSHA256();
CryptoStream macStream = new CryptoStream(stream, mac, CryptoStreamMode.Write);

AesManaged aes = new AesManaged();
var aesEncryptor = aes.CreateEncryptor();
CryptoStream aesStream = new CryptoStream(macStream, aesEncryptor, CryptoStreamMode.Write);

byte[] message = new byte[1024];
aesStream.Write(message, 0, message.Length);
aesStream.FlushFinalBlock();

//No need to FlushFinalBlock() on macStream, would throw

//Write HMAC here
stream.Write(mac.Hash, 0, mac.Hash.Length);

//Dispose
aesStream.Dispose();
aes.Dispose();
macStream.Dispose();
mac.Dispose();
4
  • I marked this as the answer, however this is not encrypt-then-MAC. This is encrypt-and-MAC. The subtle difference is that you are hashing the cleartext instead of the ciphertext. See Should we MAC-then-encrypt or encrypt-then-MAC? Sep 13, 2017 at 14:14
  • Thanks. The aesStream takes the macStream as argument. As I understand it, it hashes the encrypted stream, not the original input (message). Maybe I'm mistaken.
    – spaark
    Sep 13, 2017 at 14:21
  • 1
    Oh, sorry, you're right. The stream is encrypted then hashed. I was looking at it backward. Sep 13, 2017 at 16:31
  • sorry, when I read this it looks like the hmac stream takes the plaintext stream, and the aesStream takes the hmac stream, so it looks like the plaintext is getting hmac'd then encrypted. Am I missing something? Edit nvm it's writing not reading, so the message is written to the aesStream, which writes to the hmacStream, which writes to the client. no worries.
    – matao
    May 25, 2020 at 6:14
2

You really should perform encryption before MAC to create a secure solution, especially if you send the data over a socket (as you may be vulnerable to padding oracle attacs). So although your question is valid, it it better to change the order of the streams.

1
  • Thanks for the insight. I'll do some research on that. Mar 1, 2013 at 2:14
0

So I put a hack in place that seems to be working for the moment. I created a stream wrapper class called ProtectedStream. Here's the gist:

public class ProtectedStream : Stream
{
  private Stream stream;

  public ProtectedStream(Stream stream)
  {
    if(stream == null)
      throw new ArgumentNullException("stream");

    this.stream = stream;
  }

  public override void Close()
  {
    this.stream.Close();
    base.Close();
  }

  public override int Read(byte[] buffer, int offset, int count)
  {
    return this.stream.Read(buffer, offset, count);
  }

  public override void Write(byte[] buffer, int offset, int count)
  {
    this.stream.Write(buffer, offset, count);
  }

  // and continue overriding every other overridable Stream member
  // in the same fashion
}

And then the original code looks like this:

// assume pre-shared keys are used and set at this point
AesManaged aes = new AesManaged();
var aesEncryptor = aes.CreateEncryptor();
CryptoStream aesStream = new CryptoStream(
    stream, aesEncryptor, CryptoStreamMode.Write);

// assume pre-shared keys here too
HMACSHA256 mac = new HMACSHA256();
CryptoStream macStream = new CryptoStream(
    new ProtectedStream(aesStream), mac, CryptoStreamMode.Write);

Note that aesStream is wrapped inside a ProtectedStream. This hides the fact that aesStream is a CryptoStream from macStream so when you call FlushFinalBlock on macStream it doesn't call FlushFinalBlock on aesStream.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.