note 124244 added to function.openssl-encrypt

Please note that at the time of writing this, there is an important and naive security vulnerability in "Example #2 AES Authenticated Encryption example for PHP 5.6+". You MUST include the IV when calculating the HMAC. Otherwise, somebody could alter the IV during transport, thereby changing the decrypted message while maintaining HMAC integrity. An absolute disaster. To fix the example, the HMAC should be calculated like this: <?php $hmac = hash_hmac('sha256', $iv.$ciphertext_raw, $key, $as_binary=true); ?> ---- Server IP: 208.43.231.9 Probable Submitter: 101.0.109.162 (proxied: 85.53.94.214) ---- Manual Page -- http://php.net/manual/en/function.openssl-encrypt.php Edit -- https://master.php.net/note/edit/124244 Del: integrated -- https://master.php.net/note/delete/124244/integrated Del: useless -- https://master.php.net/note/delete/124244/useless Del: bad code -- https://master.php.net/note/delete/124244/bad+code Del: spam -- https://master.php.net/note/delete/124244/spam Del: non-english -- https://master.php.net/note/delete/124244/non-english Del: in docs -- https://master.php.net/note/delete/124244/in+docs Del: other reasons-- https://master.php.net/note/delete/124244 Reject -- https://master.php.net/note/reject/124244 Search -- https://master.php.net/manage/user-notes.php