Better error checking/message for decription. Fixed typo in docs.

git-svn-id: file:///home/mbr/svn/fwknop/trunk@69 510a4753-2344-4c79-9c09-4d669213fbeb

doc/libfko.texi

@@ -1139,7 +1139,7 @@ Decryption operation failed
 
 You can use the @code{IS_GPGME_ERROR(err_code)} macro to determine whether
 or not an error id @acronym{GPGME} related.  If the macro evaluates to a
-true value, you may be able to get additioinal information about the error
+true value, you may be able to get additional information about the error
 using the following function:
 
 @cindex gpg-specific functions

fko/fko.h

@@ -84,6 +84,7 @@ typedef enum {
     FKO_ERROR_WRONG_ENCRYPTION_TYPE,
     FKO_ERROR_MISSING_GPG_KEY_DATA,
     FKO_ERROR_DECRYPTION_SIZE,
+    FKO_ERROR_DECRYPTION_FAILURE,
     FKO_ERROR_DIGEST_VERIFICATION_FAILED,
     FKO_ERROR_UNSUPPORTED_FEATURE,
     FKO_ERROR_UNKNOWN,

fko/fko_encryption.c

@@ -100,9 +100,9 @@ _rijndael_encrypt(fko_ctx_t ctx, char *enc_key)
 int
 _rijndael_decrypt(fko_ctx_t ctx, char *dec_key, int b64_len)
 {
-    char           *tbuf;
+    char           *tbuf, *ndx;
     unsigned char  *cipher;
-    int             cipher_len, pt_len;
+    int             cipher_len, pt_len, i, err = 0;
 
     /* Now see if we need to add the "Salted__" string to the front of the
      * encrypted data.
@@ -148,12 +148,24 @@ _rijndael_decrypt(fko_ctx_t ctx, char *dec_key, int b64_len)
     */
     free(cipher);
 
-    /* The length of the decrypted data should be within 16 of the
+    /* The length of the decrypted data should be within 32 bytes of the
      * length of the encrypted version.
     */
     if(pt_len < (cipher_len - 32))
         return(FKO_ERROR_DECRYPTION_SIZE);
 
+    /* At this point we can check the data to see if we have a good
+     * decryption by ensuring the first field (16-digit random decimal
+     * value) is valid and is followed by a colon.
+    */
+    ndx = ctx->encoded_msg;
+    for(i=0; i<FKO_RAND_VAL_SIZE; i++)
+        if(!isdigit(*(ndx++)))
+            err++;
+
+    if(err > 0 || *ndx != ':')
+        return(FKO_ERROR_DECRYPTION_FAILURE);
+    
     /* Call fko_decode and return the results.
     */
     return(fko_decode_spa_data(ctx));
@@ -369,6 +381,7 @@ int
 fko_decrypt_spa_data(fko_ctx_t ctx, char *dec_key)
 {
     int             b64_len, res;
+    char           *ndx;
 
     /* First, make sure we have data to work with.
     */

fko/fko_error.c

@@ -88,6 +88,9 @@ fko_errstr(int err_code)
         case FKO_ERROR_DECRYPTION_SIZE:
             return("Unexpected or invalid size for decrypted data");
 
+        case FKO_ERROR_DECRYPTION_FAILURE:
+            return("Decryption failed or decrypted data is invalid");
+
         case FKO_ERROR_DIGEST_VERIFICATION_FAILED:
             return("The computed digest did not match the digest in the spa data");