Doc #78608 [NEW]: Security error in documentation

From: gcleaves at gmail dot com Operating system: n/a PHP version: Irrelevant Package: *Encryption and hash functions Bug Type: Documentation Problem Bug description:Security error in documentation Description: ------------ --- From manual page: https://php.net/function.openssl-encrypt --- Please note that at the time of writing this, there is an important and naive security vulnerability in "Example #2 AES Authenticated Encryption example for PHP 5.6+". You MUST include the IV when calculating the HMAC. Otherwise, somebody could alter the IV during transport, thereby changing the decrypted message while maintaining HMAC integrity. An absolute disaster. To fix the example, the HMAC should be calculated like this: <?php $hmac = hash_hmac('sha256', $iv.$ciphertext_raw, $key, $as_binary=true); ?> And to confirm the HMAC later: <?php $calcmac = hash_hmac('sha256', $iv.$ciphertext_raw, $key, $as_binary=true); ?> -- Edit bug report at https://bugs.php.net/bug.php?id=78608&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78608&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78608&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78608&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78608&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78608&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78608&r=support Expected behavior: https://bugs.php.net/fix.php?id=78608&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78608&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78608&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78608&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78608&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78608&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78608&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78608&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78608&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78608&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78608&r=mysqlcfg