Bug #73812 [Nab]: openssl_error_string() dubious when decrypting aes-128-ccm

Edit report at https://bugs.php.net/bug.php?id=73812&edit=1 ID: 73812 Updated by: bukka@php.net Reported by: anthon dot pang at gmail dot com Summary: openssl_error_string() dubious when decrypting aes-128-ccm Status: Not a bug Type: Bug Package: OpenSSL related PHP Version: 7.1.0 Assigned To: bukka Block user comment: N Private report: N New Comment: First of all I have to correct myself as it's of course about algorithm key length not block size even it is the same for aes-128 (it means 16 bytes). But for aes-256 the block size is still 128 but key size is 256 (which would be btw fine for your example) What you are doing wrong is passing 32 bytes digest to openssl_decrypt. It needs to be 16 if you use aes-128 and you don't want to see the error. What happen internally is that it tries to set cipher key length but it won't succeed for AES as its key length cannot be changed (that's why the OpenSSL error). Then the value is trimmed so it means that this openssl_decrypt($ct, $cipher, $digest, OPENSSL_RAW_DATA, $iv, $tag, $adata); is exactly the same as openssl_decrypt($ct, $cipher, substr($digest, 0, 16), OPENSSL_RAW_DATA, $iv, $tag, $adata); The second will just not give you an error. Instead of substr you can specify output size already in hash_pbkdf2. In your case: hash_pbkdf2('sha256', $password, base64_decode($input['salt']), $input['iter'], 16, true) Previous Comments: ------------------------------------------------------------------------ [2017-01-16 03:29:44] anthon dot pang at gmail dot com What are we missing here? I got the same warning when I changed $password to a 16 character string; and $digest is a hash, so it's always a 32 byte string. <?php $password = 'passwordpassword'; $input = json_decode('{"iv":"A0DOQPxWAlJ5LHjoyg==","v":1,"iter":10000,"ks":128,"ts":64,"mode":"ccm","adata":"","cipher":"aes","salt":"iGC2RaDrxUk=","ct":"3X3DKTIIE0VN0SzC9gH8k4wK3DNAsA=="}', true); $digest = hash_pbkdf2('sha256', $password, base64_decode($input['salt']), $input['iter'], 0, true); $cipher = $input['cipher'] . '-' . $input['ks'] . '-' . $input['mode']; $ct = substr(base64_decode($input['ct']), 0, - $input['ts'] / 8); $tag = substr(base64_decode($input['ct']), - $input['ts'] / 8); $iv = base64_decode($input['iv']); $adata = $input['adata']; $dt = openssl_decrypt($ct, $cipher, $digest, OPENSSL_RAW_DATA, $iv, $tag, $adata); var_dump($dt); while ($msg = openssl_error_string()) { echo $msg . "\n"; } ------------------------------------------------------------------------ [2017-01-15 21:19:05] bukka@php.net Actually missed that you pass digest. In that case it means that $digest needs to be 16 bytes (strlen($digest) === 16)... ;) ------------------------------------------------------------------------ [2017-01-15 21:16:30] bukka@php.net I mean that in your example $password needs to by 16 bytes (128 bits as it's the block size of aes-128) ------------------------------------------------------------------------ [2017-01-09 20:12:39] anthon dot pang at gmail dot com In the context of my example, do you mean $password or $digest needs to match the block length? ------------------------------------------------------------------------ [2017-01-09 18:53:16] bukka@php.net Yeah this is expected. It is due to fact that you supplied password that doesn't match the exact block length so it's either filled with 0 bytes (if short) or trimmed (if long). This behaviour cannot be changed due to BC concern. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73812 -- Edit this bug report at https://bugs.php.net/bug.php?id=73812&edit=1