Get the counter value after decrypt finished

2019-06-13 23:37发布

问题:

I am trying to decrypt AES-CTR in SSH using the keys generated by the openssh/openssh-portable library. I extracted the keys successfully from memory. Now, after some printfs and research I found out that it seems like the initial counter is incremented for every encrypted packet, which means that a successor packet(not byte) has a different Counter value as the pre-packet. For my decryption I want to decrypt packet by packet, so now my question is:

  • Can I somehow get the "end" counter of the AES counter in the pycryptodome, so that I can use the "end" counter as my new initial counter for the decryption?

My pycrypo line looks like this:

aes = AES.new(key_hex, AES.MODE_CTR, initial_value=iv_hex, nonce=b'')  

Some links:

  • Openssh aes-ctr encryption: https://github.com/openssh/openssh-portable/blob/90e51d672711c19a36573be1785caf35019ae7a8/cipher-aesctr.c
  • pycryptodome aes-ctr: https://pycryptodome.readthedocs.io/en/latest/src/util/util.html