Apple Cryptographer (Junior Level) - Interview Preparation Guide

// helpers assumed:
// void aes_cbc_decrypt_block(const uint8_t *in, uint8_t *out, const uint8_t iv[16]);
// int constant_time_compare(const uint8_t *a, const uint8_t *b, size_t len); // returns 1 if equal

int aes_cbc_decrypt_and_verify(
    const uint8_t *ciphertext, size_t clen,
    const uint8_t iv[16],
    const uint8_t *expected_tag, size_t tag_len,
    uint8_t *plaintext_out, uint8_t *work_buf /* must be at least clen */) 
{
    if (clen == 0 || (clen % 16) != 0) return -1; // public-length check only

    uint8_t prev_block[16];
    memcpy(prev_block, iv, 16);
    size_t blocks = clen / 16;

    // Decrypt all blocks into work_buf (plaintext candidate) in-order
    for (size_t i = 0; i < blocks; ++i) {
        const uint8_t *cblock = ciphertext + i*16;
        uint8_t *pblock = work_buf + i*16;
        aes_cbc_decrypt_block(cblock, pblock, prev_block);
        // prepare prev_block = cblock for next iteration (copy)
        memcpy(prev_block, cblock, 16);
    }

    // Constant-time PKCS#7 padding check
    // last byte indicates pad value 1..16
    uint8_t last_byte = work_buf[clen - 1];
    // compute pad_ok mask: 0xff if valid, 0x00 if invalid
    uint8_t pad_ok = 0xff;
    uint8_t pad = last_byte;
    // Reject pad values > 16 via constant operations
    uint8_t pad_gt_0 = (uint8_t)((pad != 0)); // 0 if pad==0
    uint8_t pad_le_16 = (uint8_t)((pad <= 16)); // relies on constant-time-friendly ops in C pseudo
    // combine into tentative mask (will refine below)
    pad_ok &= pad_gt_0 & pad_le_16;

    // Iterate over last 16 bytes and check each byte >= pad and equals pad when within pad length
    uint8_t accum = 0;
    for (size_t i = 0; i < 16; ++i) {
        size_t idx = clen - 1 - i;
        uint8_t b = work_buf[idx];
        // mask = 0xff if i < pad else 0x00
        uint8_t mask = (uint8_t)((i < pad) ? 0xff : 0x00);
        // mismatch = b ^ pad, accum |= (mask & mismatch)
        accum |= (mask & (b ^ pad));
    }
    pad_ok &= (accum == 0) ? 0xff : 0x00;

    // Constant-time tag/MAC verification (compute tag over ciphertext or plaintext as protocol requires)
    // Here assume tag is computed over plaintext_out length; we'll compute tag_input into buffer and compare
    // For example's sake assume tag computed externally; we just compare expected_tag with computed_tag
    uint8_t computed_tag[32]; // assume tag_len <= 32
    // compute_tag_constant_time(work_buf, clen - pad_value_if_valid ? pad : 0, computed_tag); 
    // For simplicity assume tag covers full plaintext after removing padding; but we must avoid branching,
    // so compute over entire work_buf and compare only constant-time:
    compute_tag_over_plaintext(work_buf, clen, computed_tag, tag_len);

    int tag_ok = constant_time_compare(computed_tag, expected_tag, tag_len); // returns 1 if equal

    // Combine flags without branching
    uint8_t ok = (pad_ok & (tag_ok ? 0xff : 0x00));

    // If ok == 0xff produce plaintext_out = work_buf without padding removed
    // else zero output — do this in constant time
    for (size_t i = 0; i < clen; ++i) {
        // byte = work_buf[i] if ok else 0
        plaintext_out[i] = work_buf[i] & ok;
    }

    return (ok == 0xff) ? 0 : -1;
}

P1 XOR P2 = C1 XOR C2

IV = PRF( IV_key, "iv" || seq ) truncated to block_size