Bug #79601 [NEW]: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

From: bizxing at web dot de Operating system: Windows 10 PHP version: Irrelevant Package: OpenSSL related Bug Type: Bug Bug description:Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV Description: ------------ openssl_encrypt generates for AES-CCM for a 12 bytes IV a wrong ciphertext and a wrong tag. Ciphertext and tag are identical to the respective values for a 7 bytes IV, which results from the 12 bytes IV when the last 5 bytes are removed. Test script: --------------- The following test vector for a 12 bytes IV is from NIST Special Publication 800-38C (https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38c.pdf), Example 3, page 18: Test vector (all data hex): Tag length: 8 bytes Key: 40414243 44454647 48494a4b 4c4d4e4f Nonce/IV: 10111213 14151617 18191a1b AAD: 00010203 04050607 08090a0b 0c0d0e0f 10111213 Plaintext: 20212223 24252627 28292a2b 2c2d2e2f 30313233 34353637 Ciphertext || Tag (last 8 bytes): e3b201a9 f5b71a7a 9b1ceaec cd97e70b 6176aad9 a4428aa5 484392fb c1b09951 The following script calculates ciphertext and tag for this test vector. Additionally, ciphertext and tag are determined for the 7 bytes IV that results from the 12 bytes IV when the last 5 bytes are removed: <?php function printTag($plaintext, $key, $iv, $aad, $taglength){ $encrypted = openssl_encrypt($plaintext, 'aes-128-ccm', $key, OPENSSL_RAW_DATA, $iv, $tag, $aad, $taglength); print('ciphertext: ' . bin2hex($encrypted) . ' - tag: ' . bin2hex($tag) . "\n"); } $key = hex2bin('404142434445464748494a4b4c4d4e4f'); $aad = hex2bin('000102030405060708090a0b0c0d0e0f10111213'); $plaintext = hex2bin('202122232425262728292a2b2c2d2e2f3031323334353637'); $tagLength = 8; $iv = hex2bin('101112131415161718191a1b'); // 12 bytes printTag($plaintext, $key, $iv, $aad, $tagLength); // ciphertext: 7162015bc051951e5918aeaf3c11f3d4ac363f8d5b6af3d3 - tag: af9831fb22f8931f $iv = hex2bin('10111213141516'); // 7 bytes printTag($plaintext, $key, $iv, $aad, $tagLength); // ciphertext: 7162015bc051951e5918aeaf3c11f3d4ac363f8d5b6af3d3 - tag: af9831fb22f8931f ?> Expected result: ---------------- For the input data of the test vector, openssl_encrypt calculates that ciphertext and that tag which are specified in the test vector. Actual result: -------------- For the input data of the test vector, openssl_encrypt calculates a ciphertext and a tag that are different from those specified in the test vector. Ciphertext and tag are identical to the respective values for a 7 bytes IV, which results from the 12 bytes IV of the test vector when the last 5 bytes are removed. -- Edit bug report at https://bugs.php.net/bug.php?id=79601&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79601&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79601&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79601&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79601&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79601&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79601&r=support Expected behavior: https://bugs.php.net/fix.php?id=79601&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79601&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79601&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79601&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79601&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79601&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79601&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79601&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79601&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79601&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79601&r=mysqlcfg