You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by "naruto-lgtm (via GitHub)" <gi...@apache.org> on 2026/10/23 09:13:52 UTC
[PR] AgileDecryptor: verify the DataIntegrity HMAC before decrypting [poi]
naruto-lgtm opened a new pull request, #1465:
URL: https://github.com/apache/poi/pull/1465
AgileDecryptor.getDataStream hands out the decrypting stream without checking the DataIntegrity HMAC that MS-OFFCRYPTO 2.3.4.14 requires: verifyPassword already recovers the HMAC key and value, but the post-validation left as a TODO in AgileCipherInputStream was never implemented, so a package whose ciphertext was altered after encryption decrypts into silently corrupted content where Office rejects the file as damaged. The HMAC is now computed over the whole EncryptedPackage stream, StreamSize field included, before any data is decrypted, and a mismatch raises EncryptedDocumentException; checking up front keeps the guarantee independent of how far a consumer reads or skips, at the cost of one extra pass over the encrypted stream. Every agile sample in test-data (Office SHA-1 and SHA-512 variants and the fuzzed protected_agile.docx) still decrypts unchanged, and the new TestAgileDecryptor case flips one ciphertext byte and fails before this change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] AgileDecryptor: verify the DataIntegrity HMAC before decrypting [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning merged PR #1465:
URL: https://github.com/apache/poi/pull/1465
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] AgileDecryptor: verify the DataIntegrity HMAC before decrypting [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #1465:
URL: https://github.com/apache/poi/pull/1465#issuecomment-6390183413
seems ok, so I merged -I will add some changes in a follow up pr though
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org