Bug->Doc #78628 [Opn]: AES-256-XTS cipher method does not work

From: Date: Sun, 08 Dec 2019 18:47:11 +0000
Subject: Bug->Doc #78628 [Opn]: AES-256-XTS cipher method does not work
References: 1  Groups: php.doc.bugs 
Request: Send a blank email to doc-bugs+get-17097@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=78628&edit=1

 ID:                 78628
 Updated by:         bukka@php.net
 Reported by:        alec@php.net
 Summary:            AES-256-XTS cipher method does not work
 Status:             Open
-Type:               Bug
+Type:               Documentation Problem
 Package:            OpenSSL related
 Operating System:   Linux
 PHP Version:        7.3.10
 Block user comment: N
 Private report:     N

 New Comment:

Yeah I think this is more documentation issue. Some ciphers require different handling so we
shouldn't state that "penssl_encrypt() accepts methods returned from
openssl_get_cipher_methods()". In a similar way chacha20-poly1305 doesn't work as AEAD -
requested in https://bugs.php.net/bug.php?id=76935 .


Previous Comments:
------------------------------------------------------------------------
[2019-12-02 09:07:02] alec@php.net

I don't really have a use-case, but documentation says that openssl_encrypt() accepts methods
returned from openssl_get_cipher_methods(). No mention about some being not implemented or buggy.

The function throws E_WARNING in some cases, maybe that's another case for E_WARNING. Or maybe
you have to just make it working.

------------------------------------------------------------------------
[2019-12-01 19:44:59] bukka@php.net

I think XTS needs a bit more handling so it's not fully supported. We could change this to the
request to add support for it but wondering what the actual use case for XTS is in PHP world?
It's mainly meant for disk encryption from what I know about this mode.

------------------------------------------------------------------------
[2019-10-04 11:06:27] alec@php.net

Additional info:
$ openssl list -cipher-algorithms | grep XTS
AES-128-XTS
AES-256-XTS

------------------------------------------------------------------------
[2019-10-03 11:10:13] alec@php.net

Description:
------------
Tested with various PHP versions (7.3.9 and 7.4.0beta4 and some older 7.x) on Ubuntu 18.04. This
originates from on of our users using PHP 7.3 on Debian Stable.

$php -r "print_r(openssl_get_cipher_methods());" | grep -i xts
    [12] => aes-128-xts
    [35] => aes-256-xts

However, if you see the test script openssl_enrypt() does not work, returns false. No error/warning.
The same for AES-128-XTS.

I'm not sure what is expected from OpenSSL in the system, but openssl ciphers -v | grep
XTS returns nothing.

Maybe that's not a bug, but I'd like to hear some explanation for this behavior.

Test script:
---------------
$iv = random_bytes(openssl_cipher_iv_length("aes-256-XTS"));
echo openssl_encrypt("test", "aes-256-XTS", "key", OPENSSL_RAW_DATA,
$iv) === false;

Expected result:
----------------
0

Actual result:
--------------
1


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=78628&edit=1

Thread (13 messages)

« previous php.doc.bugs (#17097) next »