#43143 [Opn->Asn]: Warning about empty IV with MCRYPT_MODE_ECB.
| From: | tony2001@php.net | Date: | Mon, 12 Nov 2007 10:05:07 +0000 |
| Subject: | #43143 [Opn->Asn]: Warning about empty IV with MCRYPT_MODE_ECB. | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-119506@lists.php.net to get a copy of this message | ||
ID: 43143
Updated by: tony2001@php.net
Reported By: dylan at wedefy dot com
-Status: Open
+Status: Assigned
Bug Type: mcrypt related
Operating System: Windows XP
PHP Version: 5.2.4
-Assigned To:
+Assigned To: derick
New Comment:
Assigned to the maintainer.
Previous Comments:
------------------------------------------------------------------------
[2007-10-30 14:21:58] dylan at wedefy dot com
Description:
------------
This warning makes sense for the other block cipher modes, but when
using MCRYPT_MODE_ECB the initialization vector is not used at all, so
it is misleading to recommend using one. In fact there should be a
notice/warning when an IV is supplied with mode MCRYPT_MODE_ECB to alert
that the IV is ignored.
Reproduce code:
---------------
<?php
$input = 'to be encrypted';
$mkey = hash('sha256', 'secret key', TRUE);
$data = mcrypt_encrypt(MCRYPT_RIJNDAEL_256, $mkey, $input,
MCRYPT_MODE_ECB);
?>
Expected result:
----------------
no warning
Actual result:
--------------
PHP Warning: mcrypt_encrypt(): Attempt to use an empty IV, which is
NOT recommend
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=43143&edit=1