CyberRota Analysis
AI-GeneratedThe vulnerability affects wolfProvider versions prior to 1.2.2, where the AES-GCM nonce is generated only once per connection, leading to the reuse of the same key and nonce for all records in a TLS 1.2 or DTLS 1.2 session. This flaw allows attackers to exploit the keystream through known ciphertexts, potentially enabling them to forge authentication tags and compromise data integrity. Organizations using affected versions of wolfProvider for TLS 1.2 or DTLS 1.2 should prioritize patching to mitigate the risk of data exposure and unauthorized access.
Original NVD Description
wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.