|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27455 mdecrypt_generic() fails all but 'ecb' with mcrypt_module_close()
Submitted: 2004-03-02 03:14 UTC Modified: 2004-03-02 14:57 UTC
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: robert at peakepro dot com Assigned:
Status: Not a bug Package: mcrypt related
PHP Version: 4.3.4 OS: RH Linux, Mac OS X
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: robert at peakepro dot com
New email:
PHP Version: OS:


 [2004-03-02 03:14 UTC] robert at peakepro dot com
I noticed all the examples in the online documentation 
do not actually close out the mcrypt module, they simply 
deinit. This is not an accurate simulation of a real-
world use, where an encrypted string may be stored and 
later retreived long after the module has been closed. 

I encountered this potential bug when running the loop I 
posted on the mcrypt main page. It seems that in all 
modes except ecb, mcrypt fails to decrypt encrypted 
strings after the module has been closed. At first I 
thought it was just my system or my libmcrypt, but I 
have tried this on multiple machines with the same 

Reproduce code:

Expected result:
The same results as in the source code posted in 
mcrypt_module_open() i.e. the original string.

Actual result:
Garbled output that varies with each new call.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-02 03:31 UTC]
This is not a bug at all; you HAVE to use the same IV for both encrypting and decrypting otherwise the algorithm is pointed in the wrong way. The reason why it works with ECB is because that is the only mode not using an IV.

See also:
and further slides, and
 [2004-03-02 14:51 UTC] robert at peakepro dot com
Thanks for the quick reply. I'll look into this and 
ammend my contribution to the manual as appropriate. I'm 
guessing if this wasn't clear to me it may not have been 
clear to a lot of people.
 [2004-03-02 14:57 UTC]
Yup, it's something mistaken by a lot of people. (I set the status back to bogus, as this is not a bug in PHP).
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Sat Apr 01 15:03:39 2023 UTC