{"record":{"id":"3cb2d93987b12fae","repo":"peass-ng/PEASS-ng","slug":"decryption-failed-due-to-mac-mismatch","errorCode":null,"errorMessage":"Decryption failed due to MAC mismatch","messagePattern":"Decryption failed due to MAC mismatch","errorType":"exception","errorClass":"System.Security.Cryptography.CryptographicException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/Info/CloudInfo/GWorkspaceInfo.cs","lineNumber":300,"sourceCode":"            // Perform the decryption using Bouncy Castle\n            try\n            {\n                GcmBlockCipher gcm = new GcmBlockCipher(new Org.BouncyCastle.Crypto.Engines.AesEngine());\n                AeadParameters parameters = new AeadParameters(new KeyParameter(key), macLength * 8, nonce);\n                gcm.Init(true, parameters);\n\n                byte[] plaintext = new byte[gcm.GetOutputSize(actualCiphertext.Length)];\n                int len = gcm.ProcessBytes(actualCiphertext, 0, actualCiphertext.Length, plaintext, 0);\n                int len2 = gcm.DoFinal(plaintext, len);\n\n                string plaintextString = Encoding.ASCII.GetString(plaintext, 0, len+len2-mac.Length);\n                \n\n                return plaintextString;\n            }\n            catch (InvalidCipherTextException ex)\n            {\n                throw new CryptographicException(\"Decryption failed due to MAC mismatch\", ex);\n            }\n        }\n\n        private static bool IsPrefixMatch(byte[] ciphertext, byte[] versionPrefixBytes)\n        {\n            for (int i = 0; i < versionPrefixBytes.Length; i++)\n            {\n                if (ciphertext[i] != versionPrefixBytes[i])\n                    return false;\n            }\n            return true;\n        }\n\n        private static byte[] PerformCryptography(byte[] data, ICryptoTransform cryptoTransform)\n        {\n            using (MemoryStream ms = new MemoryStream())\n            {\n                using (CryptoStream cryptoStream = new CryptoStream(ms, cryptoTransform, CryptoStreamMode.Write))","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/Info/CloudInfo/GWorkspaceInfo.cs#L282-L318","documentation":"During AES-GCM decryption the Bouncy Castle library raised InvalidCipherTextException, meaning the GCM authentication tag did not verify. The method wraps it in a CryptographicException with this message. The data is wrong, tampered with, or being decrypted with the incorrect key/nonce derivation — never proceed with the plaintext (which is not returned anyway).","triggerScenarios":"Calling decryptedToken where the AES key (recovered from the app-bound key via system DPAPI) does not match the one used to encrypt, the nonce was mis-sliced from the ciphertext, or the ciphertext bytes were truncated/modified in transit.","commonSituations":"Running as a user whose DPAPI scope cannot decrypt the app-bound key (wrong user/SYSTEM context); Chrome updated and key format changed; copying only part of the registry REG_BINARY value; handling a token encrypted by a different machine/profile.","solutions":["Confirm the key retrieval chain: app-bound key from registry must first be decrypted with system-level DPAPI (as SYSTEM) before use as the AES key","Verify nonce extraction: check that nonce is copied from exactly versionPrefixBytes.Length offset with the correct nonceLength (12 bytes for GCM)","Re-read the full ciphertext blob; ensure no truncation or string encoding round-trips (always keep byte[]/REG_BINARY intact)","Run the decryption in the correct security context (elevated/SYSTEM for Chromium app-bound keys)","Log the inner InvalidCipherTextException for diagnosis, but treat MAC failure as authentication failure, not a retry case"],"exampleFix":"// before\nbyte[] key = regReader.ReadRegistryValue(keyPath, valueName); // raw DPAPI blob used directly\nbyte[] plain = DecryptWithAESGCM(cipher, key, \"v20\");\n// after\nbyte[] appBound = regReader.ReadRegistryKey(keyPath, valueName);\nbyte[] key = SystemCrypto.ProtectedData.Unprotect(appBound, null, DataProtectionScope.LocalMachine); // decrypt with SYSTEM DPAPI\nbyte[] plain = DecryptWithAESGCM(cipher, key, \"v20\");","handlingStrategy":"try-catch","validationCode":"// MAC mismatch cannot be predicted; only ensure inputs are complete and correctly ordered\nstatic bool PlausibleInput(byte[] ct, byte[] key, int nonceLen, int prefixLen) =>\n    ct != null && ct.Length > prefixLen + nonceLen + 16 && key != null && key.Length == 32;","typeGuard":null,"tryCatchPattern":"try { return DecryptWithAESGCM(ct, key, prefix); }\ncatch (CryptographicException ex)\n{\n    log.Error($\"AES-GCM auth failed (wrong key/nonce or tampered data): {ex.InnerException?.Message}\");\n    return null; // never retry blindly; fix key derivation first\n}","preventionTips":["Decrypt the app-bound key with SYSTEM-level DPAPI before using it as the AES key","Verify nonce offset (after version prefix) and length (12 bytes) exactly match the format","Keep REG_BINARY blobs intact — no truncation, no text encoding round-trips","Run decryption in the same security context the key was encrypted for (elevated/SYSTEM)","Treat every MAC failure as an authentication event worth logging, never a silent retry"],"tags":["csharp","cryptography","aes-gcm","mac-mismatch","dpapi"],"backgroundTag":"gcm-tag-verification-failed","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}