Handling over sized keys on OpenSSL

From: Date: Sun, 01 Sep 2019 03:33:59 +0000
Subject: Handling over sized keys on OpenSSL
Groups: php.internals 
Request: Send a blank email to internals+get-106827@lists.php.net to get a copy of this message
Hi Internals, I just spent this entire Saturday debugging a code to discover that OpenSSL truncates over sized keys. Yeah, I was using a 256-bit length key with AES-128-CBC then trying to decrypt it in another program never works. Did some research I found that Ruby did it a few years ago <https://github.com/ruby/ruby/commit/ce635262f53b760284d56bb1027baebaaec175d1?fbclid=IwAR2W3mJEljXwedq4VkhWjkXO0fsiEliORsuPSN2YqOAhkZk1fGfC3CqkPaU> . And in fact, its better to throw or even warn/notice about it instead of silently allowing it, *what you think?* Regards, Leo

« previous php.internals (#106827) next »