Req #72247 [Com]: There is no way to get key length for cipher algorithms

Edit report at https://bugs.php.net/bug.php?id=72247&edit=1 ID: 72247 Comment by: ameliabr dot nnr at gmail dot com Reported by: S-sword at s-sword dot net Summary: There is no way to get key length for cipher algorithms Status: Analyzed Type: Feature/Change Request Package: OpenSSL related Operating System: Windows10/CentOS7.2 PHP Version: master-Git-2016-05-20 (Git) Block user comment: N Private report: N New Comment: There is a new function in PHP 8.2 called openssl_cipher_key_length that can get the cipher key length for a given cipher algorithm12. This function returns an integer representing the length in bytes of the key required for the cipher algorithm, or false on failure1. For example, the following code will output: PHP <?php $method = 'AES-128-CBC'; var_dump(openssl_cipher_key_length($method)); ?> AI-generated code. Review and use carefully. More info on FAQ. If you are using an older version of PHP, you may have to use a workaround to get the key length. One possible solution is to use the openssl_get_cipher_methods function to get an array of available cipher methods, and then use a regular expression to extract the key length from the method name (https://github.com)(https://www.rtasks.online/) For example, the following code will output: PHP <?php $cipher = 'aes-256-cbc'; $ciphers = openssl_get_cipher_methods(); foreach ($ciphers as $c) { if (preg_match('/^'.$cipher.'-(\d+)-/i', $c, $matches)) { $key_len = $matches[1] / 8; break; } } echo "Key length for {$cipher}: {$key_len}\n"; ?> Previous Comments: ------------------------------------------------------------------------ [2019-09-19 01:55:11] bishop@php.net Key length available via either EVP_CIPHER_key_length or EVP_CIPHER_CTX_key_length. Would need to decide if we're going to support variable length ciphers or not. Eg, a signature of: openssl_get_key_length(string $cipher): int|false or openssl_get_key_length(string $cipher, string $encryption_mode): int|false ------------------------------------------------------------------------ [2016-05-20 02:46:09] S-sword at s-sword dot net Description: ------------ Current implementation of OpenSSL functions has openssl_cipher_iv_length, obtaining the initialize vector length for ciphers, but no way to get key length. Moreover, in the function openssl_encrypt, the argument $password is used simply as key and cut off if longer than algorithm specified max key length (see below example). Then it is insecure to pass the raw password to openssl_enctypt, so we want to apply PBKD; Password Based Key Derivation, in php implemented as Hash functions (hash_pbkdf2), but this algorithm requires the key length. This is why we cannot migrate from mcrypt to openssl (in mcrypt functions, mcrypt_get_key_size is defined). To summarize the above, we need the way to get max key length for cipher algorithms, like openssl_cipher_key_length. Test script: --------------- echo(openssl_encrypt('aaa', 'aes-256-cbc', str_pad('', 256, '0')).PHP_EOL); echo(openssl_encrypt('aaa', 'aes-256-cbc', str_pad('', 300, '0')).PHP_EOL); // These two code pass different passwords to openssl_encrypt but get same result. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72247&edit=1