WIP @ Challenge 15
@@ -8,6 +8,12 @@ import org.owasp.wrongsecrets.challenges.Spoiler;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
+import javax.crypto.Cipher;
+import javax.crypto.spec.GCMParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.util.Arrays;
+import java.util.Base64;
import java.util.List;
@Slf4j
@@ -15,6 +21,8 @@ import java.util.List;
@Order(15)
public class Challenge15 extends Challenge {
+ private String[] preStoredEncryptedAccessKeys;
+
public Challenge15(ScoreCard scoreCard) {
super(scoreCard);
}
@@ -56,4 +64,32 @@ public class Challenge15 extends Challenge {
* output = json
* region = us-east-2
*/
+
+ private boolean matchesEncryptedString(String base64Offered){
+ try {
+ final byte[] keyData = "v9y$B&E)H@MbQeThWmZq4t7w!z%C*F-J".getBytes(StandardCharsets.UTF_8);
+ int aes256KeyLengthInBytes = 16;
+ byte[] key = new byte[aes256KeyLengthInBytes];
+ System.arraycopy(keyData, 0, key, 0, 16);
+ Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
+ SecretKeySpec keySpec = new SecretKeySpec(key, "AES");
+ int gcmTagLengthInBytes = 16;
+ int gcmIVLengthInBytes = 12;
+ byte[] initializationVector = new byte[gcmIVLengthInBytes];
+ Arrays.fill(initializationVector, (byte) 0); //done for "poor-man's convergent encryption", please check actual convergent cryptosystems for better implementation ;-)
+ GCMParameterSpec gcmParameterSpec = new GCMParameterSpec(gcmTagLengthInBytes * 8, initializationVector);
+ cipher.init(Cipher.ENCRYPT_MODE, keySpec, gcmParameterSpec);
+ byte[] cipherTextBytes = cipher.doFinal(base64Offered.getBytes(StandardCharsets.UTF_8));
+ String cipherText= Base64.getEncoder().encodeToString(cipherTextBytes);
+ for(String encryptedAccessKey: preStoredEncryptedAccessKeys){
+ if (cipherText.equals(encryptedAccessKey)){
+ return true;
+ }
+ }
+ return false;
+ } catch (Exception e) {
+ log.error("Exception with Challenge 15", e);
+ return false;
+ }
+ }
}
