Doc #76071 [NEW]: function.openssl-encrypt php 5.6 code example it poor from a security standpoin

From: junk at gathond dot dk Operating system: ANY PHP version: Irrelevant Package: Documentation problem Bug Type: Documentation Problem Bug description:function.openssl-encrypt php 5.6 code example it poor from a security standpoin Description: ------------ --- From manual page: http://www.php.net/function.openssl-encrypt --- The example code has a few items which if not downright security issues, at least is bad practice from a security POV. issue 1: The IV should be included in the HMAC calculation, otherwise this is left open to manipulation. issue 2: When decrypting the MAC should be verified before attempting to decrypt the contents, otherwise any timing impacts on the decryption itself may still leak information about the correctness of the guess. Because of issue 1 it would probably also be better to reorder the data in the example so it is $iv.$ciphertext_raw.$hmac instead. -- Edit bug report at https://bugs.php.net/bug.php?id=76071&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76071&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76071&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76071&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76071&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76071&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76071&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76071&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76071&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76071&r=support Expected behavior: https://bugs.php.net/fix.php?id=76071&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76071&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76071&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76071&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76071&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76071&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76071&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76071&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76071&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76071&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76071&r=mysqlcfg