Hector Martin

If you read anything, from BitLocker reversing tool source to articles to FIPS reports, it says it uses AES-CCM to wrap keys. It doesn't. It uses AES-CTR. Somehow everyone has managed to write AES-CTR implementations and call them AES-CCM. WTF.

The only thing "CCM" about it is that it prepends (15 - nonce_len - 1) (so 0x02) to nonces. It doesn't use a MAC. It doesn't have associated data. And crucially, it doesn't use the first keystream block for that, which definitely makes it not CCM and not compatible with CCM.

Lol, I take that back. It *is* CCM, it's just that libbde incorrectly implements it as CTR and it works by accident (and returns 16 bytes of garbage before the plaintext). The correct ciphertext format is <12b nonce><16b tag><ciphertext>, not <12b nonce><ciphertext>.