Edit report at https://bugs.php.net/bug.php?id=75804&edit=1
ID: 75804
Updated by: cmb@php.net
Reported by: sergiuthepenguin at gmail dot com
Summary: authenticated encryption tag is broken
-Status: Closed
+Status: Re-Opened
Type: Feature/Change Request
Package: OpenSSL related
Operating System: Windows and GNU/Linux
PHP Version: 7.1.13
Assigned To: bukka
Block user comment: N
Private report: N
New Comment:
phpdocbot was not supposed to close this. :)
Previous Comments:
------------------------------------------------------------------------
[2020-08-20 17:20:07] phpdocbot@php.net
Automatic comment on behalf of mumumu
Revision: http://git.php.net/?p=doc/ja.git;a=commit;h=244520d6ee50dfe57266368e3b24adc75eedc474
Log: Fix #75804: authenticated encryption tag is broken
------------------------------------------------------------------------
[2020-08-20 10:34:54] cmb@php.net
This issue has now been documented[1]. Changing to feature
request.
[1] <<http://svn.php.net/viewvc?view=revision&revision=350346>>
------------------------------------------------------------------------
[2020-02-09 19:55:10] bukka@php.net
This is known thing and that's how OpenSSL works as well. I agree that we should document this.
Not sure about extra parameter as that's pretty easy to do in user land. Also we would need a
default value which would break the cases that use shorter tag. But I guess this could be acceptable
for 8.0. Might be a good idea though.
------------------------------------------------------------------------
[2018-01-26 17:21:27] sergiuthepenguin at gmail dot com
Thanks for confirming.
IMHO, the documentation should be updated to warn developers about manually verifying the tag length
using isset($tag[$chosenLength - 1]) or mb_strlen($tag, '8bit').
Speaking of which, is it not possible for openssl_decrypt to have a tag length argument for internal
checks?
------------------------------------------------------------------------
[2018-01-26 16:23:03] ab@php.net
Thanks for the shorter code. I can reproduce the issue with OpenSSL 1.0.2 and 1.1.0. The linked Ruby
issue is actually same. Here's even a shorter reproducer
$text = 'The quick brown fox jumps over the lazy dog.';
$key = random_bytes(32);
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-gcm'));
$cipherText = openssl_encrypt($text, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag,
'test-aad', 16);
$ret = openssl_decrypt($cipherText, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag[0],
'test-aad');
var_dump($ret);
This prints the decrypted text, more logic were IMO bool(false).
I'd say it's definitely not a good behavior. In how far it is a security issue, is another
question. An application should assert the correct tag length in first place. However, this behavior
definitely increases the security risk due to programmer mistakes. The documentation states the tag
length accepted by openssl_encrypt is between 4 and 16, however the below comes through with the tag
length of 3
$cipherText = openssl_encrypt($text, 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag,
'test-aad', 3);
We need to discuss further how this should be fixed. Perhaps raising the default tag length could be
a solution, something like to 12 bytes as a default for AES. This of course doesn't eliminate
the need to check this in the application.
Thanks.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=75804
--
Edit this bug report at https://bugs.php.net/bug.php?id=75804&edit=1