AES-128 GCM (IETF RFC 5084)

[ValeryBi]

Hi,

would it be possible to add support for AES-128-GCM as defined in RFC 5084? This is required for S/MIME in the context of German network operator communication.

BouncyCastle already supports this, but MimeKit currently doesn't, which makes full handling of such messages tricky without workarounds.

[jstedfast]

This is probably something we can add.

[jstedfast]

Are you able to use AES-128 GCM with any other software? E.g. Outlook?

If you send some test messages using that software and then look at the raw MIME message data, does it have:

Content-Type: application/pkcs7-mime; smime-type=authenveloped-data

or does it have:

Content-Type: application/pkcs7-mime; smime-type=enveloped-data

[jstedfast]

It looks like I need to wait for BouncyCastle to implement a CmsAuthEnvelopedDataGenerator class before this can be truly supported. And probably also more infrastructure as well.

[jstedfast]

ping

Need info.

[ValeryBi]

Unfortunately, as far as I know, no common client currently supports this algorithm. With Outlook I can only view the header with the following content but cannot decrypt the e-mail:

Content-Type: application/pkcs7-mime; name="smime.p7m"; smime-type=authEnveloped-data

I hope this helps.

[ggrote]

I think our issue is related to this. We also try to decrypt some network operator mails with the smine-type set to 'authEnvelopedData'.
Trying to decrypt the messages fails with the exception:

Org.BouncyCastle.Crypto.InvalidCipherTextException: mac check in GCM failed
bei Org.BouncyCastle.Crypto.Modes.GcmBlockCipher.DoFinal(Byte[] output, Int32 outOff)
bei Org.BouncyCastle.Crypto.BufferedAeadBlockCipher.DoFinal(Byte[] output, Int32 outOff)
bei Org.BouncyCastle.Crypto.BufferedAeadBlockCipher.DoFinal(Byte[] input, Int32 inOff, Int32 inLen)
bei Org.BouncyCastle.Crypto.IO.CipherStream.ReadAndProcessBlock()
bei Org.BouncyCastle.Crypto.IO.CipherStream.FillInBuf()
bei Org.BouncyCastle.Crypto.IO.CipherStream.Read(Byte[] buffer, Int32 offset, Int32 count)
bei System.IO.BufferedStream.Read(Byte[] array, Int32 offset, Int32 count)
bei Org.BouncyCastle.Utilities.IO.FilterStream.Read(Byte[] buffer, Int32 offset, Int32 count)
bei MimeKit.MimeParser.ReadAhead(Int32 atleast, Int32 save, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 668.
bei MimeKit.MimeParser.ScanContent(Byte* inbuf, Stream content, Boolean trimNewLine, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 1434.
bei MimeKit.MimeParser.ConstructMimePart(MimePart part, MimeEntityEndEventArgs args, Byte* inbuf, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 1484.
bei MimeKit.MimeParser.MultipartScanSubparts(Multipart multipart, Byte* inbuf, Int32 depth, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 1656.
bei MimeKit.MimeParser.ConstructMultipart(Multipart multipart, MimeEntityEndEventArgs args, Byte* inbuf, Int32 depth, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 1719.
bei MimeKit.MimeParser.ParseEntity(Byte* inbuf, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 1891.
bei MimeKit.MimeParser.ParseEntity(CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeParser.cs:Zeile 1929.
bei MimeKit.MimeEntity.Load(ParserOptions options, Stream stream, Boolean persistent, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeEntity.cs:Zeile 1358.
bei MimeKit.MimeEntity.Load(Stream stream, Boolean persistent, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\MimeEntity.cs:Zeile 1495.
bei MimeKit.Cryptography.BouncyCastleSecureMimeContext.Decrypt(Stream encryptedData, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\Cryptography\BouncyCastleSecureMimeContext.cs:Zeile 1905.
bei MimeKit.Cryptography.ApplicationPkcs7Mime.Decrypt(SecureMimeContext ctx, CancellationToken cancellationToken) in D:\src\MimeKit\MimeKit\Cryptography\ApplicationPkcs7Mime.cs:Zeile 367.

But it looks like the decryption of the message works, the exception is thrown while trying to construct the mimepart of the Smime.p7m segment.

[ggrote]

BouncyCastle already supports this, but MimeKit currently doesn't, which makes full handling of such messages tricky without workarounds.

Do you have a working workaround in place?

[jstedfast]

Thanks @ValeryBi,

This was definitely one of the pieces of info I needed: Content-Type: application/pkcs7-mime; name="smime.p7m"; smime-type=authEnveloped-data

And that confirms what I was suspecting.

Unfortunately, this means BouncyCastle does not yet support this functionality afaict because it does not support authEnveloped-data.

[jstedfast]

@ggrote

But it looks like the decryption of the message works, the exception is thrown while trying to construct the mimepart of the Smime.p7m segment.

Not quite correct.

The stack trace shows that while MimeKit is getting an exception parsing, the exception is actually coming from BouncyCastle's decryption logic.

What happens MimeKit asks BouncyCastle to decrypt through a streaming API which MimeKit then uses as it's input stream for parsing.

When BouncyCastle's decrypt logic throws an exception, that bubbles up through MimeKit's parser.

Look at the first few frames of the exceptions stacktrace to see what I'm saying.

[jstedfast]

Looks like there are 2 issues that need to be fixed in BouncyCastle first:

1. Error getting Content from CmsEnvelopedData with AES128-GCM #354
2. Encrypting with Aes256Gcm, public key certificate and CmsEnvelopedDataGenerator throws error - 2.2.1 decryption fix broke encryption #475

Looks like there's a work-around someone came up with for #475, but my concern is that it might not produce something that can be decrypted.