Hacking Bug in OpenSSL

[Bug_Checker_]

For those people who maybe messing around with naehrwert's gateway stuff, This is just a heads up. There appears to be a bug in the latest (11-Feb-2013) OpenSSL ver 1.0.1e (only tested on Win64 build).
the error is as follows:

bad decrypt
11016:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:.\crypto\evp\evp_enc.c:539:
error in enc

It will truncate the decrypted launcher file by 16 bytes. The work around is to pad the ENCRYPTED file by 16 null bytes(00). You will still receive the above error message but the file will be identical to release launcher_dec.bin.

 

[Vappy]

I got the same bug on the linux version, zecoxao helpfully shared his little tool made with polarssl that gave me the completed file. Good to know it's a simple fix like that though!

 

[Bug_Checker_]

Sorry, (just to amend my earlier post) simply adding the "nopad" switch seems to solve the problem w/o having to append any info to original file.
So for IV=00 :
openssl enc -d -aes-128-cbc -K <key> -iv 00 -nopad -in <infile> -out <outfile>
or
enc -d -aes-128-cbc -K <key> -iv 00 -nopad -in <infile> -out <outfile>

 

[octopus]

He released something:
https://twitter.com/naehrwert/status/417678526179835904