Bug #70625 [Opn]: mcrypt_encrypt() : won't return data when no IV was specified under RC4.

Edit report at https://bugs.php.net/bug.php?id=70625&edit=1 ID: 70625 Updated by: nikic@php.net Reported by: jparedes at gmail dot com Summary: mcrypt_encrypt() : won't return data when no IV was specified under RC4. Status: Open Type: Bug Package: mcrypt related Operating System: Linux PHP Version: 5.6 Block user comment: N Private report: N New Comment: The issue here is that mcrypt_enc_mode_has_iv() reports on a property of the mode only, and reports the stream cipher mode to have an IV, regardless of used cipher. mcrypt_enc_get_iv_size() returns a property of the cipher, in this case 0, which seems to be the signal for "doesn't actually need an IV, even if mode_has_iv() says so". So we should add an additional check for 0 expected IV size. Previous Comments: ------------------------------------------------------------------------ [2015-10-02 20:17:22] jparedes at gmail dot com unintentionally changed affected php version while editing in parallel. Reverting. ------------------------------------------------------------------------ [2015-10-02 20:13:32] jparedes at gmail dot com I correct myself, issue seems to arise after this commit 25d801f [1], because -if i'm not wrong- it's assumes RC4 encmode should have IV and it fact it should not. [1] https://github.com/php/php-src/commit/25d801f97ec3f4bcac8977efd50f843eba9b19e1 ------------------------------------------------------------------------ [2015-10-02 20:12:38] nikic@php.net This is due to the additional IV validation in PHP 5.6: https://3v4l.org/af8oG Probably some special handling for stream ciphers is missing. ------------------------------------------------------------------------ [2015-10-02 19:41:57] jparedes at gmail dot com Apparently the introduction of zpp checks [1]is in effect what causes the difference in the desired behaviour. This emerged in php-7.0.0beta3. [1] https://github.com/php/php-src/commit/d8ed84e4c4d0bd0bac88d2c0ed6e072a7d7ea49d ------------------------------------------------------------------------ [2015-10-02 19:14:04] jparedes at gmail dot com Description: ------------ Ommiting $iv in mcrypt_encrypt() under MCRYPT_ARCFOUR cipher returns false. But when "null" parameter is specified it work as expected. Test script: --------------- <?php //This works php<7.0 only $enc_value = mcrypt_encrypt(MCRYPT_ARCFOUR,'secretkey','payload',MCRYPT_MODE_STREAM); var_dump($enc_value); //This work tested under 7.0RC4 $enc_value = mcrypt_encrypt(MCRYPT_ARCFOUR,'secretkey','payload',MCRYPT_MODE_STREAM,null); var_dump($enc_value); Expected result: ---------------- The result of $enc_value should be the result of the encryption. Actual result: -------------- Function returns false. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70625&edit=1