[php-src] Issue #10208: openssl with aes not thread safe!

From: Date: Mon, 02 Jan 2023 14:09:30 +0000
Subject: [php-src] Issue #10208: openssl with aes not thread safe!
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-243312@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/10208 Author: mokraemer ### Description Running php-fpm with multiple instances. Due to the changes of openssl 3, I changed the encryption from blowfish to "aes-128-gcm". If this is run in a frequent environment (encrypt session data), it fails with different errors of files unable to open, ... The following code: ```php $data='test'; $key=substr('abcdefghijklmnopqrstuvwxyz',0,16); $iv=random_bytes((int) openssl_cipher_iv_length('aes-128-gcm')); $tag=''; $ret = (string) openssl_encrypt($data, 'aes-128-gcm',$key, OPENSSL_RAW_DATA, $iv, $tag); if(($err = openssl_error_string())){ echo $err; }else{ echo 'ok'; } <?php ``` Resulted in this output: ``` error:2406F079:random number generator:RAND_load_file:Cannot open file error:24070079:random number generator:RAND_write_file:Cannot open file error:0909006C:PEM routines:get_name:no start line error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt ``` But I expected this output instead: ``` ok ``` This only happens, if executed in frequent used environment - in php-fpm. If relevant: opcache is used. ### PHP Version PHP 8.1.13 ### Operating System Mageia 8 (Linux)

« previous php.bugs (#243312) next »