note 110047 deleted from function.openssl-encrypt by cmb
| From: | cmb@php.net | Date: | Fri, 01 Jul 2016 17:26:48 +0000 |
| Subject: | note 110047 deleted from function.openssl-encrypt by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-205859@lists.php.net to get a copy of this message | ||
Note Submitter: kasper at webmasteren dot eu
----
For security reasons, if NOT encrypting using a (cryptographically) random IV, then the IV itself
must be entryptet as well ( this is not handled behind the scene).
the reason is that it leads to predictable IV's, which then breaks semantic security. [this
kind of attack can already be done on ssl/ TLS 1.1].