You are an attacker trying to gain access to a BobDevice Pro™, an enterprise IoT device. As is common for enterprise devices, when logging into the BobDevice Pro™ the username/password checking are actually handled by an external authentication server, rather than on the BobDevice Pro™ itself. The auth server will send one of two types of packets to the BobDevice Pro™: either a packet that starts with Access Granted!!, which tells the BobDevice Pro™ that login should succeed, or one that starts with Access Denied!!!, which makes the login fail.
You, the attacker, might pretend to be the auth server and send the BobDevice Pro™ an Access Granted!! packet to trick it into letting you log in. To prevent this, the BobDevice Pro™ shares a secret key with the auth server, and expects all packets from the auth server to include a valid MAC.
Luckily for you, the MAC scheme the protocol uses is the Super Advanced Deluxe Message Authentication Code, or SADMAC for short, which is utterly broken. SADMAC first pads the message by appending a 0xff byte followed by the minimum number of 0x00 bytes needed to make the length a multiple of 16 bytes. It then runs AES128 on each 16-byte block of the message separately and xors the results together, giving a single 16-byte value. Finally, it encrypts the resulting value with AES128 again to produce the authentication tag.
Your task is to produce the correct tag on any packet that starts with Access Granted!!. You don't know the secret key, but you can easily get the auth server to send any Access Denied!!! packet you want, along with the valid tag. So you'll need to carry out a UF-CMA sort of attack, but one where there are restrictions on what messages you can make Tag queries on.
Download the starter code and fill in the relevant functions. You can test your code locally by running python3 hw2.py. Turn your solution in to the HW2 assignment on Gradescope. Make sure when you turn it in it's still named hw2.py, and don't forget to list your collaborators!
As a side note, this is a highly simplified version of a real attack called Blast-RADIUS; your instructor was one of the authors. The MAC used in RADIUS isn't quite as easily breakable as SADMAC, and there are other complications around what messages you can see tags of and how to trick the server into sending them, but the overall goal is still to forge a tag of an Access-Accept based on seeing the tag of an Access-Reject.