Bug #80430 [NEW]: openssl_encrypt() is not verifying that key is present or not.

From: m dot saifmumtaz at gmail dot com Operating system: Linux OpenSuse Tumbleweed PHP version: 7.4.13 Package: OpenSSL related Bug Type: Bug Bug description:openssl_encrypt() is not verifying that key is present or not. Description: ------------ openssl_encrypt() is not verifying the key lenght for given ciphering method. it encrpts and decrypts even with empty key. it is not verifying the key in any mode even with aes-gcm have same problem Test script: --------------- $key=""; $plaintext = "message to be encrypted"; $cipher = "aes-128-cbc"; if (in_array($cipher, openssl_get_cipher_methods())) { $ivlen = openssl_cipher_iv_length($cipher); $iv = openssl_random_pseudo_bytes($ivlen); $ciphertext = openssl_encrypt($plaintext, $cipher, $key, $options=0, $iv); //store $cipher, $iv, and $tag for decryption later $original_plaintext = openssl_decrypt($ciphertext, $cipher, $key, $options=0, $iv); echo $original_plaintext."\n"; } Expected result: ---------------- it must throw error if key length is not enough or empty. -- Edit bug report at https://bugs.php.net/bug.php?id=80430&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=80430&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=80430&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=80430&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=80430&r=needscript Try newer version: https://bugs.php.net/fix.php?id=80430&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=80430&r=support Expected behavior: https://bugs.php.net/fix.php?id=80430&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=80430&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=80430&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=80430&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=80430&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=80430&r=dst IIS Stability: https://bugs.php.net/fix.php?id=80430&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=80430&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=80430&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=80430&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=80430&r=mysqlcfg