?
Solved

SSPI encryption/decryption problem

Posted on 2002-07-10
5
Medium Priority
?
885 Views
Last Modified: 2012-06-21
I have a client/server system that uses the Windows SSPI interface to authenticate NT user accounts and allow encrypted data to be passed across the network (via NTLM / Kerberos). It all works fine but there is a problem with the encrypted data transfer.

If a encrypt a message on the client side and then decrypt it on the server everything is ok. If I encrypt the data on the client side, then encrypt another message on the server side and try to decrypt the original message, I get SEC_E_MESSAGE_ALTERED returned from both DecryptMessage calls. Obviously it doesn't like the fact that the message Encrypt / Decrypt sequence is not in order, but I need to send encrypted messages in both directions at any time.

I have tried removing the ISC_REQ_SEQUENCE_DETECT and ISC_REQ_REPLAY_DETECT flags in InitializeSecurityContext but this has no effect. I've also tried jst about everything else I can think of.

Happens under NT4 and Win2K.

Thanks,

Jamie
0
Comment
Question by:JamieR
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 49

Accepted Solution

by:
DanRollins earned 1000 total points
ID: 7148349
What parameters are you using in EncryptMessage and DecryptMessage?  The MessageSeqNo might be critical.  Perhaps you need to get a second SecurityContext

Q245565 mentions a problem encountered by MsExchange in which two packets are processed in a single I/O operation, so when it tries to process the second block there is no data and it fails with that error.  Maybe you are hitting the same sort of thing.  Have you verified that there is good, decryptable data in the buffer when you call DecrpytMessage?

-- Dan  

0
 
LVL 1

Author Comment

by:JamieR
ID: 7151735
Actually I figured it out. Thanks for the help anyway.
0
 
LVL 49

Expert Comment

by:DanRollins
ID: 7151778
I'd rather that you not sully my grading record with a C, and I'm certain that most Experts here feel the same.  Please refer to the grading guidelines:

   http://www.experts-exchange.com/jsp/cmtyQuestAnswer.jsp#3

It is your responsibility to provide feedback to the Expert.  For instance, you could say "Shall I delete this, or do you want to me stick you with a C?"  Then when the experts replies with "You can stick that C where the sun don't shine" then you'll know the way the wind is blowing.

On another matter:
When you grade a question it gets saved into the PAQ database.  When someone later searches with keywords such as SEC_E_MESSAGE_ALTERED or DecryptMessage, then this question will be listed.  They might then purchase this question (50 points) and be rather unsatisfied since there is no answer here (C-level or otherwise).  

So could you please post a brief synopsis of what you did to solve this problem?  Thanks!

-- Dan
0
 
LVL 1

Author Comment

by:JamieR
ID: 7152909
Dan,

We resolved the issue before I had the opportunity to read your response. I started to describe the solution, but decided not to post it since there were several obscure issues in our code (not the CryptoAPI) and it would have been of little benefit to anyone else. It's also not my property.

I thought your reply was intelligent and helpful. I assumed you'd be grateful for the easy 500 points, not offended!

Jamie
0
 
LVL 49

Expert Comment

by:DanRollins
ID: 7152986
>>I assumed you'd be grateful for the easy 500 points, not offended!

Then this is a pivotal moment for you as you learn how Experts feel about getting bad grades.  Looking at your grading histroy I see that you have even given D's to experts who help you!  Nobody likes to be told that they are a third-class expert and nobody want s C or a D tarnishing their record.  If you want to thank an expert, you can post a 500-point question "Points For..." (and please, give an A!) but don't accept a non-answer as a low-grade answer.

Please review the grading guidelines carefully and please follow them in the future.  Thanks!

-- Dan
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows you how to optimize memory allocations in C++ using placement new. Applicable especially to usecases dealing with creation of large number of objects. A brief on problem: Lets take example problem for simplicity: - I have a G…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
The goal of the video will be to teach the user the difference and consequence of passing data by value vs passing data by reference in C++. An example of passing data by value as well as an example of passing data by reference will be be given. Bot…
The viewer will learn how to user default arguments when defining functions. This method of defining functions will be contrasted with the non-default-argument of defining functions.
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question