Crypto example not giving correct output for AES 256 CFB

[Mathew Key]

nRF52832 and SDK 17.0.2

Using the Examples/crypto/nrf_crypto/aes/aes_all_cli example I am getting the wrong output in CFB mode.

"example key_size 256_bit"

"example aes cfb"

The Nordic code is outputting

97 E8 C2 8A 2A 73 24 81 13 D1 78 8C B2 72 2F 2F
F1 93 C7 13 F6 4B A4 7C FB FC 25 A8 0A 77 B3 7E
EF 2B 33 BD 2B 17 4F B2 B7 B0 47 9D 22 2F 30 BB
36 CA 93 57 6F 0D 25 55 8B 24 F5 EA 1D DF C7 27

and then decrypting it back to the original.

However, our Android code is outputting a different result (using same Plaintext, Key and IV). More importantly, GCHQ's online example is ALSO outputting the same as our Android code

gchq.github.io/.../

a52d17bc1928db89d62758d0042b357b1ea13a942eae5f4681046550fd53764147ff960033c38da94e2993f46b905479dd8a494e171cb9e4834f2c38286261e3

If  I switch to using ECB mode then its fine.

Also as a side note, you have a minor formatting bug in plain_text_print in main.c. The format string is "%2x" when it should be "%02x". Leadings zeros are being missed.

[Vidar Berg]

Hello,

Looks like the problem is that we use the CFB8 mode in our implementation while GCHQ and Android is using CFB128. The IV input was also different as it  was UTF-8 encoded on the website.

Result with the correct IV input:

https://gchq.github.io/CyberChef/#recipe=AES_Encrypt(%7B'option':'UTF8','string':'NORDIC%20SEMICONDUCTORAES%26MAC%20TEST'%7D,%7B'option':'Hex','string':'0000000000000000000000000000000'%7D,'CFB','Hex','Hex','')&input=NDEgNDUgNTMgMjAgNjUgNzggNjEgNkQgNzAgNkMgNjUgMjAgNjQgNjUgNkQgNkYKNkUgNzMgNzQgNzIgNjEgNzQgNjkgNkUgNjcgMjAgNjIgNjEgNzMgNjkgNjMgMjAKNzUgNzMgNjEgNjcgNjUgMjAgNkYgNjYgMjAgNkUgNzIgNjYgNUYgNjMgNzIgNzkKNzAgNzQgNkYgMkUgMjAgNTQgNjUgNzMgNzQgMjAgNzMgNzQgNjEgNzIgNzQgMkUK

[Mathew Key]

Yeap - silly "typo" on my end on the GCHQ link.

However, is there any way to tell the Nordic version to use the CFB128? If not I guess I just switch back to CBC mode as thats matching the GCHQ sites version

[Vidar Berg]

There does not appear to be a configuration setting for this, unfortunately. However, I think it should work if you replace the call to mbedtls_aes_crypt_cfb8() with mbedtls_aes_crypt_cfb128() in your code.