CVE-2026-16000 in bc-csharp
Summary
by MITRE • 10/02/2026
Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypted without associated data. The cause is that the G1 block, which binds the nonce, the message length and the parameter flags into the CBC-MAC, was processed only when associated data was present. Without associated data the tag was a CBC-MAC of the plaintext alone, independent of the nonce. Only applications that use KCcmBlockCipher directly and supply no associated data are affected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in Legion of the Bouncy Castle Inc.'s bc-csharp library prior to version 2.7.0 represents a critical failure in the implementation of the DSTU 7624 standard, specifically within the CCM mode encryption mechanism known as KCcmBlockCipher. This flaw fundamentally undermines the integrity and authenticity guarantees that authenticated encryption modes are designed to provide. The core issue stems from an omission in the cryptographic processing sequence where the G1 block is not generated or processed when no associated data is provided by the application developer. In a correct CCM implementation, this G1 block serves as a crucial binding element that incorporates the nonce, the length of the plaintext message, and specific parameter flags into the CBC-MAC computation. By skipping this step in scenarios where associated data is absent, the resulting authentication tag becomes mathematically decoupled from these essential parameters.
From a technical perspective, the absence of the G1 block processing means that the computed authentication tag is derived solely from the plaintext content via the CBC-MAC algorithm. This creates a scenario where the nonce and message length are effectively ignored during the integrity check phase. Consequently, an attacker who can observe encrypted messages containing known or chosen plaintexts can exploit this structural weakness to forge new ciphertexts that will possess valid authentication tags. The forged messages do not need to match any specific original transmission; they simply require a valid tag for their respective content, which the flawed implementation allows because it does not verify the nonce consistency within the MAC calculation itself in these specific cases. This breaks the fundamental security property of authenticated encryption, allowing for forgery attacks that compromise data integrity without necessarily breaking confidentiality if the underlying block cipher remains secure against other attack vectors.
The operational impact of this vulnerability is severe for any application relying on bc-csharp's KCcmBlockCipher for secure communication where no additional associated data is supplied. Such applications are left with a false sense of security, as they believe their messages are authenticated and tamper-proof when in fact the authentication mechanism is defective. An adversary capable of intercepting network traffic or accessing stored encrypted data can manipulate ciphertexts to alter the meaning of communications while ensuring that the receiving system accepts them as legitimate due to the valid but improperly generated tags. This could lead to unauthorized actions, financial fraud, or corruption of critical systems depending on the application's function. The risk is particularly acute in protocols where nonce reuse might occur, although even with unique nonces, the lack of binding between the tag and the message context allows for targeted forgery attacks that are difficult to detect through standard integrity checks alone.
This vulnerability aligns closely with CWE-327, which describes the use of a broken or risky cryptographic algorithm, specifically highlighting failures in authenticated encryption implementations where authentication tags do not properly bind all necessary inputs such as nonces and lengths. Furthermore, from an offensive security perspective, this flaw facilitates techniques categorized under MITRE ATT&CK T1565, Data Manipulation, particularly sub-techniques involving stored data or transmitted data manipulation. Attackers can leverage this weakness to inject malicious payloads into secure channels without triggering integrity alerts. To mitigate this risk, organizations must immediately upgrade the bc-csharp library to version 2.7.0 or later, where the G1 block processing logic has been corrected to ensure that nonces and message lengths are always included in the CBC-MAC calculation regardless of whether associated data is present. Until an update can be applied, developers should avoid using KCcmBlockCipher for any security-critical operations involving unauthenticated contexts and consider switching to alternative implementations or libraries that have undergone rigorous formal verification and peer review to ensure compliance with cryptographic standards.