Beware of Magic in AES CBC

In case of encrypted text I commonly see “magic” footer being used as a sole verification method for AES CBC; i.e. assumption is that, if last bytes were decrypted correctly, all previously decrypted bytes are valid too. However, that assumption can fail horribly.

Once case when it fails is when configurable IV is used. You can have nonsense for a IV vector and decryption will succeed. Even worse, while first few bytes will be invalid, 8-byte blocks following it will look just fine. If you validate content only by last few bytes, your program might happily continue to work without any issue.

But lets assume you have static IV and that this issue doesn’t affect you. And you are worried only about stream errors anyhow. Well, I hate to inform you but CBC mode is self-synchronizing, i.e. any recoverable errors in one block will go away after certain number of blocks. For example, if you have an error in first byte of a stream, next fifteen bytes will be corrupted but rest of stream (including your footer) will look just fine.

Corruption in the middle of stream will cause exception most of the time, but not always. If it passes unnoticed you can have valid header, valid footer and garbage in between.

As you can see from the two examples above, you cannot rely purely on fact that some stream bytes were decrypted as a proof that some other part of stream is not corrupted. Only way to be sure about stream validity is to use hash/CRC functions that were actually designed to detect corruption.

Example of both these behaviors is available for download. Below is example output with both valid and invalid decryption having a same footer (FF-FF-FF-FF):

Decrypted (OK) ..........: 00-01-02-03-04-05-06-07-08-09-0A-0B-0C-0D-0E-0F-10-11-12-13-FF-FF-FF-FF
Decrypted (invalid IV) ..: FF-01-02-03-04-05-06-07-08-09-0A-0B-0C-0D-0E-0F-10-11-12-13-FF-FF-FF-FF
Decrypted (invalid input): 31-33-7C-D9-A9-91-47-DD-52-3A-64-08-FD-2F-D4-C8-1D-11-12-13-FF-FF-FF-FF

Bon Voyage

Illustration

For almost five years now I had a Kindle 2 as my companion. Other Kindles came and went and I saw no reason to replace something still working. But there was one thing bugging me for a while now - reading by night. I was pretty much looking to upgrade to Paperwhite when Amazon announced Voyage. So I jumped onto that train.

I decided upon Voyage 3G since I still fondly remember my Kindle 2 keeping me in touch with a world in a foreign expensive land before the age of WiFi. First shock happened when I tried to browse. Amazon actually doesn’t allow browsing on 3G anymore. You can visit Amazon, you can visit Wikipedia, but nothing else is reachable without WiFi. Compared to unrestricted Kindle 2 this seemed as a step backward.

I was also stunned by the fact I could not access my own web site. Since I could access it at an alternate address I would tend to blame this on the lack of SSL Server Name Indication support which I find really strange since Kindle advertises it as an WebKit browser. My guess would be that they’re using quite an older version of SSL code when it manages to fail at thing even Internet Explorer 7 supports.

WiFi itself is 2.4 GHz only which is a bit of disappointment. This is quite literally the newest device I own and only one that has no 5 GHz radio. Yes, 2.4 GHz is more common choice for consumers also but I find 5 GHz a blessing in a crowded environment (e.g., in cities).

Build quality is quite good with a glass front and a magnesium back with a soft finish plastic over it. Only disappointment was a slight misalignment of plastic hiding the antennas with the rest of the body. Fortunately it is not in place where you can easily touch it and it might be only an issue with my device anyhow.

In order to turn the device on you need to reach button on the back. Without cover this operation is annoying at the best. Fortunately, as soon as you get some cover on, things get easier and comfortable. Also annoying is “Swipe to unlock Kindle” gesture at every damn turn on. It is completely unnecessary and serves absolutely no purpose other than showing off the fact you have a touchscreen. This is also solved by putting a cover on (but only if you have version without special offers). As you might deduce, this Kindle is less than enjoyable without a cover.

Since Voyage is a really young device only original Amazon cover is Origami I personally find annoying at best. I’m hoping that Amazon will start selling just a simple leather cover too as same one is available for their other devices. Of course you can always opt for a third-party cover.

On other hand I just adore PagePress buttons. Lack of physical buttons on Paperwhite was what was keeping me back on Kindle 2. Sadly, due to a touchscreen controls, lefties might not really enjoy buttons as they would otherwise. Bezel is really thin so my page turning finger naturally tends to rest at the edge of the screen. This means that each touch to left PagePress button also probably touches screen where that same gesture is interpreted as going one page back.

In the end my page turn occasionally gets interpreted either as nothing at all or as a turn backward. It doesn’t happen often but it kills my flow immediately. Software solution would be simple - just disable touch screen page turns when PagePress is enabled but I doubt that anything will be done since 90% of right-handed people will be just fine with this.

Speaking of page turns, I find it a slightly unnecessary to have a PagePress back button on both sides. Since going backward is a pretty rare operation, having second back button replaced with Home (again, as on Kindle 2) would make more sense to me.

Missing when compared to the Kindle 2 is also any form of audio. While I used read-aloud functionality rarely enough that I won’t miss it, I do miss capability of getting my audio books on it. I dream of a day when I will be able to switch between listening to unabridged audio book and reading it on screen. A beautiful thing when you prefer reading but occasionally want audio (e.g., when driving a car).

Another surprise came when I tried charging Voyage. It would only pull around 500 mA from wall chargers. Compared to 900 mA Kindle 2 could pull this is a real disappointment. I tried using the original Amazon 5W charger but current usage remained the same. Unless Amazon’s fast charger (9W) does better job, I can only deduce that somebody in engineering did a shoddy job and 500 mA is the maximum.

Regardless of all these annoyances I covered in the last few paragraphs, I really enjoy this Kindle. Screen is gorgeous, backlight really pleasant, and it does feel as an upgrade coming from Kindle 2. Even if you are coming from the latest generation Paperwhite you will find new Kindle enjoyable and a quality device. Biggest issue for it will probably be the price since $200 for the basic model and $270 for the 3G one is quite a premium.

All in all I really love this Kindle. Yes, it is not perfect but it is a great companion.

PS: Due to such a crippled 3G, I returned my original purchase and got myself a WiFi-only Voyage.

Visual Studio Community 2013

Illustration

A bit over a week ago a new Visual Studio edition has appeared pretty much out of blue. For all practical purposes you can look at it as a cross between Visual Studio Professional (has same features) and Express editions (it’s free).

Unlike Express editions, Community can only be used by an individual developer, for open source, for learning/teaching, and in a small non-enterprise settings. If you are working for enterprise company, you’re out of luck.

Since Community is essentially the same as a Professional edition, there is not much new things that can be said about it. It can slice, it can dice, and it is an almost perfect development environment. Yes, there are Premium and Ultimate and they do offer some advantages (e.g. IntelliTrace is a gem) but most of the time one can live without those features just fine. Unlike with the Express editions you won’t feel constrained with the Community.

Surprisingly you cannot really install Community edition side-by-side with any other paid Visual Studio. Official explanation is that this is because Community is the part of a same line as other editions but I still find it an unfortunate decision. Developers wearing two hats in BYOD scenarios (e.g. enterprise by day, open source by night) might get into some conflicting situations. Side-by-side with the Express editions will still be supported so not all is black.

Speaking of Express editions, it is not really clear to me what is their destiny. Currently they do stand together with Community but they do overlap quite a bit. If we learned anything from the past, their days are numbered. I would like to be wrong since I do love them. Even with all their shortcomings, I can still see them useful in multiple scenarios (mostly due to their quite permissive licence). I will miss them.

If you currently don’t have anything better than Express on your machine and you fit into the restrictions, it is definitely worth checking out.

Windows Installation Media Creation Tool

Illustration

For quite a long time Windows 7 USB/DVD Download Tool was the easiest way to create your bootable USB. Yes, it had its issues (e.g. didn’t work for UEFI) but it usually did its work. Only issue was where to get install media in the first place.

Well, now Microsoft gave us Windows Installation Media Creation Tool. As soon as you start it (no installation possible) you will get a selection of languages, editions (Standard/Pro), and architecture (x86/x64). Afterward you select whether you want to create a bootable USB or save it as an ISO file and, after a lengthy download, you will have your installation media. Perfect!

However, tool is not really perfect. First of all, it seems to have issues with some USB drives. I tried three different SanDisk Cruzer Fit USB drives and neither of them was even recognized by the tool: “We can’t find a USB flash drive. Insert one and try again.” This is first time ever I saw issue like this in any program.

One drive it did recognize (Super Talent’s Pico-C) was deemed too small although it’s size was required 4 GB. Yes, I know disk manufacturers like to count bytes a bit differently but I am puzzled by that 4 GB requirement. Pretty much all Windows installations are just slightly over 3 GB so better approach would be just to compare given flash size to selected installation media. And there is no technical reason since I could manually create a bootable drive from downloaded ISO just fine.

If you have a limited bandwidth, beware. Utility downloads a new file every time. It doesn’t matter if you just downloaded ISO five minutes ago and now you just want to create a bootable media. It will redo the whole download. Seems wasteful to me.

It would also help if default selections would match running system rather than being empty. The whole idea is to give you installation media for your machine and this gets quite a bit annoying if you are inexperienced user trying to guess which release you are currently running.

But all in all, I am happy with this tool for its ISO download capability. It finally makes it possible to do the pristine installation on your machine with original Microsoft media without having to be MSDN subscriber.

PS: If everything else fails, you can always make USB install manually.

Lollipop, Lollipop, Oh Lolli, Lolli, Lolli

Illustration

As I saw today Android 5.0 (Lollipop) factory images, I got a twitch going on. Yes, I could wait OTA a week or so or I could install the newest Android OS on my phone immediately at the cost of data. It took me a whole second to know the answer.

First step was to install Java. I took latest x64 Java Development Kit and got that pest (temporarily) on my machine. Next step was to get Android SDK Tools. I opted to get it as a standalone install.

Upon starting Android SDK Tools, I just installed all packages offered by default. Nitpickers might say that you only need Platform Tools and Google USB Driver but I find it much easier to click Next, Next, Next until cows come home or all needed gets installed.

Last part of puzzle was actual factory image for Nexus 4. All files from it I unpacked in the same directory where fastboot.exe was installed. Since I took all defaults this was at %USERPROFILE%\AppData\Local\Android\android-sdk\platform-tools.

Now I powered off my mobile phone and powered it back on while holding Volume down button. This brought me into the FastBoot mode and I connected my USB cable only to have device not be recognized. Therefore I had to go to the Device Manager and right-click Android device with a yellow question mark. Selecting Update Driver Software and then pointing dialog to the SDK directory (%USERPROFILE%\AppData\Local\Android\android-sdk in my case) allowed installation of Google’s USB Driver.

Now I could start cmd.exe and unlock my phone:

cd %USERPROFILE%\AppData\Local\Android\android-sdk\platform-tools
fastboot oem unlock

This gave me a warning prompt on my mobile phone. To select Yes I had to use volume keys for the movement and power key for the confirmation. First step done.

Next step was to actually flash the phone. Fortunately Google provided nice script for that so I just started it (still in the %USERPROFILE%\AppData\Local\Android\android-sdk\platform-tools directory):

flash-all.bat
 sending 'bootloader' (2264 KB)...
 OKAY [  0.076s]
 writing 'bootloader'...
 OKAY [  0.294s]
 finished. total time: 0.374s
 rebooting into bootloader...
 OKAY [  0.004s]
 finished. total time: 0.006s
 …
 sending 'cache' (10984 KB)...
 OKAY [  0.375s]
 writing 'cache'...
 OKAY [  0.602s]
 rebooting...
 finished. total time: 87.058s
 Press any key to exit...

After two minutes your phone was be rebooting with a brand new OS. First reboot took quite some time (eight minutes on my device) so have some patience was needed.

After setting everything up I rebooted the phone once more into the FastBoot mode (power off; VolumeDown+Power). Then I started cmd.exe one last time and brought the lock back:

cd %USERPROFILE%\AppData\Local\Android\android-sdk\platform-tools
fastboot oem lock
fastboot reboot

And with that installation of Lollipop was over.

PS: Interesting tidbit: during initial Lollipop setup I could only see 2.4 GHz wireless networks. As soon as I was connected, 5 GHz networks became visible too.