usama khan 537d06f593 OSCORE: Roll back replay window on decryption failure ...

oscore_validate_sender_seq() moves the replay window on before the
message has been decrypted, and oscore_roll_back_seq() is meant to undo
that when decryption fails. It only restored last_seq and
sliding_window when the saved values were non zero, and never restored
initial_state. For a recipient context still in its initial state
(rfc8613_b_1_2 false), or one whose last_seq is 0, a single request
with a forged Partial IV and an invalid tag left last_seq at the
sender's chosen value, so the genuine peer's following requests were
rejected as outside the replay window.

The client did not roll back at all when a response failed decryption,
and the server called oscore_update_seq_num_cb() with the new window
before decrypting the request, so credential storage could be updated
with a forged sequence number even when the in memory window was
restored.

Record whether there is a window update to undo and restore
initial_state with it, roll back on response decryption failure as
well, and only call oscore_update_seq_num_cb() once the request has
been decrypted.

Add a unit test.

2026-10-22 12:56:02 +01:00

..

coap3

coap_resource.c: Do not hold the next subscriber across a notification

2026-10-17 12:43:11 +01:00

oscore

OSCORE: Roll back replay window on decryption failure

2026-10-22 12:56:02 +01:00