|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27455 mdecrypt_generic() fails all but 'ecb' with mcrypt_module_close()
Submitted: 2004-03-02 03:14 UTC Modified: 2004-03-02 14:57 UTC
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: robert at peakepro dot com Assigned:
Status: Not a bug Package: mcrypt related
PHP Version: 4.3.4 OS: RH Linux, Mac OS X
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: robert at peakepro dot com
New email:
PHP Version: OS:


 [2004-03-02 03:14 UTC] robert at peakepro dot com
I noticed all the examples in the online documentation 
do not actually close out the mcrypt module, they simply 
deinit. This is not an accurate simulation of a real-
world use, where an encrypted string may be stored and 
later retreived long after the module has been closed. 

I encountered this potential bug when running the loop I 
posted on the mcrypt main page. It seems that in all 
modes except ecb, mcrypt fails to decrypt encrypted 
strings after the module has been closed. At first I 
thought it was just my system or my libmcrypt, but I 
have tried this on multiple machines with the same 

Reproduce code:

Expected result:
The same results as in the source code posted in 
mcrypt_module_open() i.e. the original string.

Actual result:
Garbled output that varies with each new call.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-02 03:31 UTC]
This is not a bug at all; you HAVE to use the same IV for both encrypting and decrypting otherwise the algorithm is pointed in the wrong way. The reason why it works with ECB is because that is the only mode not using an IV.

See also:
and further slides, and
 [2004-03-02 14:51 UTC] robert at peakepro dot com
Thanks for the quick reply. I'll look into this and 
ammend my contribution to the manual as appropriate. I'm 
guessing if this wasn't clear to me it may not have been 
clear to a lot of people.
 [2004-03-02 14:57 UTC]
Yup, it's something mistaken by a lot of people. (I set the status back to bogus, as this is not a bug in PHP).
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Apr 14 15:01:29 2024 UTC