{"action":"created","issue":{"url":"https://api.github.com/repos/vim/vim/issues/638","repository_url":"https://api.github.com/repos/vim/vim","labels_url":"https://api.github.com/repos/vim/vim/issues/638/labels{/name}","comments_url":"https://api.github.com/repos/vim/vim/issues/638/comments","events_url":"https://api.github.com/repos/vim/vim/issues/638/events","html_url":"https://github.com/vim/vim/issues/638","id":133880780,"number":638,"title":"Vim cryptmethod is not authenticated","user":{"login":"atoponce","id":699572,"avatar_url":"https://avatars.githubusercontent.com/u/699572?v=3","gravatar_id":"","url":"https://api.github.com/users/atoponce","html_url":"https://github.com/atoponce","followers_url":"https://api.github.com/users/atoponce/followers","following_url":"https://api.github.com/users/atoponce/following{/other_user}","gists_url":"https://api.github.com/users/atoponce/gists{/gist_id}","starred_url":"https://api.github.com/users/atoponce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atoponce/subscriptions","organizations_url":"https://api.github.com/users/atoponce/orgs","repos_url":"https://api.github.com/users/atoponce/repos","events_url":"https://api.github.com/users/atoponce/events{/privacy}","received_events_url":"https://api.github.com/users/atoponce/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":43,"created_at":"2016-02-16T04:14:22Z","updated_at":"2016-02-19T21:44:35Z","closed_at":"2016-02-19T10:37:32Z","body":"When using `cryptmethod=blowfish2`, the saved ciphertext is not authenticated with a message authentication code (\"MAC tag\"). Consider saving \"Lorem ipsum dolor sit amet, consectetur adipiscing elit.\" to a text file, and getting the SHA-256 digest of the ciphertext:\r\n\r\n    $ vim -x /tmp/lorem.txt\r\n    (Use \"vim\" as the passphrase)\r\n    $ sha256sum /tmp/lorem.txt\r\n    510e57357353d511dac719bc238900456332ca0e4c00bcf12d244fdc66355f8e  /tmp/lorem.txt\r\n\r\nNow deliberately corrupt the file:\r\n\r\n    $ dd seek=50 conv=notrunc bs=1 count=10 if=/dev/urandom of=/tmp/lorem.txt\r\n    10+0 records in\r\n    10+0 records out\r\n    10 bytes copied, 0.000293754 s, 34.0 kB/s\r\n\r\nNotice the SHA-256 digest has changed. Open the file, and notice that the plaintext has changed:\r\n\r\n    $ sha256sum /tmp/lorem.txt \r\n    f17d3494643ed8bef5f0ba7fd67af6682f0332a0bccf52e9a2640604bec0b111  /tmp/lorem.txt\r\n    $ vim -x /tmp/lorem.txt\r\n    (Use \"vim\" as the passphrase)\r\n\r\nI get \"Lorem ipsum dolor sit £ÕH<8a>`7^T¸³­#÷f;Qü×¦adipiscing elit.\" returned. Your mileage may vary.\r\n\r\nIf the ciphertext was authenticated with a cryptographically secure hashing function ([Skein](https://en.wikipedia.org/wiki/Skein_%28hash_function%29) by Bruce Schneier would be fitting, given the use of his Blowfish algorithm as the symmetric cipher), and if the MAC tag was calculated on the ciphertext, then when attempting to decrypt, if the MAC tag did not match the newly calculated MAC tag, Vim should error out, rather than decrypting and displaying the file. See the Wikipedia article on \"[Encrypt-then-MAC](https://en.wikipedia.org/wiki/Authenticated_encryption#Encrypt-then-MAC_.28EtM.29)\".\r\n\r\nVim should use \"Encrypt-then-MAC\" authenticated encryption when using `cryptmethod`."},"comment":{"url":"https://api.github.com/repos/vim/vim/issues/comments/186421261","html_url":"https://github.com/vim/vim/issues/638#issuecomment-186421261","issue_url":"https://api.github.com/repos/vim/vim/issues/638","id":186421261,"user":{"login":"vim-ml","id":11653528,"avatar_url":"https://avatars.githubusercontent.com/u/11653528?v=3","gravatar_id":"","url":"https://api.github.com/users/vim-ml","html_url":"https://github.com/vim-ml","followers_url":"https://api.github.com/users/vim-ml/followers","following_url":"https://api.github.com/users/vim-ml/following{/other_user}","gists_url":"https://api.github.com/users/vim-ml/gists{/gist_id}","starred_url":"https://api.github.com/users/vim-ml/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vim-ml/subscriptions","organizations_url":"https://api.github.com/users/vim-ml/orgs","repos_url":"https://api.github.com/users/vim-ml/repos","events_url":"https://api.github.com/users/vim-ml/events{/privacy}","received_events_url":"https://api.github.com/users/vim-ml/received_events","type":"User","site_admin":false},"created_at":"2016-02-19T21:44:35Z","updated_at":"2016-02-19T21:44:35Z","body":"On Friday, February 19, 2016 at 2:28:51 PM UTC-6, Thiago de Arruda wrote:\n> \n> If the encrypted file is stored in a shared server(or alternatives suggested by @atoponce: Dropbox, Google Drive, NFS, Samba shares) a sysadmin could brute force a weak password since Vim uses sha256 as KDF. Then it would simply be a matter of encrypting the desired code(eg: an uncovered modeline bug) and replacing the real ciphertext with the fabricated one. When the user restores the backup on his own machine and decrypts the file, the code would execute since there's no MAC validation)\n> \n\nExcept, if the nefarious admin has brute-forced the password to re-encrypt with desired modifications, then they'll just recalculate the MAC as well, right? So MAC wouldn't help for this attack. Better KDF for sure, though; we can't expect everyone to use 100+ bits of entropy in a password :-)"}}