kawaandClaude Sonnet 4.6
74535ea089
The reference implementation (svrooij/ContentPrep Zipper.cs DecryptFileAsync) reads the first 32 bytes as the stored HMAC, then hashes the *remaining* bytes — i.e. IV (16 bytes) || ciphertext — to verify integrity. ImpTune was computing HMAC(mac_key, ciphertext) which omits the IV. Intune's server-side HMAC check would therefore always fail, manifesting as the same silent symptom as the Detection.xml bug: empty wizard fields, greyed OK button, no error banner. The blob layout is unchanged: [HMAC(32)] + [IV(16)] + [ciphertext]. Only the hash input is corrected: iv + ciphertext instead of ciphertext. The Mac field in Detection.xml is also updated accordingly (it stores the same HMAC value that is prepended to the blob). Tests updated: test_hmac_matches now verifies HMAC over blob[32:] (= IV+ciphertext), which is exactly what the reference decryption algorithm verifies against. All 114 tests pass. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>