|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27455 mdecrypt_generic() fails all but 'ecb' with mcrypt_module_close()
Submitted: 2004-03-02 03:14 UTC Modified: 2004-03-02 14:57 UTC
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: robert at peakepro dot com Assigned:
Status: Not a bug Package: mcrypt related
PHP Version: 4.3.4 OS: RH Linux, Mac OS X
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem:
24 - 21 = ?
Subscribe to this entry?

 [2004-03-02 03:14 UTC] robert at peakepro dot com
I noticed all the examples in the online documentation 
do not actually close out the mcrypt module, they simply 
deinit. This is not an accurate simulation of a real-
world use, where an encrypted string may be stored and 
later retreived long after the module has been closed. 

I encountered this potential bug when running the loop I 
posted on the mcrypt main page. It seems that in all 
modes except ecb, mcrypt fails to decrypt encrypted 
strings after the module has been closed. At first I 
thought it was just my system or my libmcrypt, but I 
have tried this on multiple machines with the same 

Reproduce code:

Expected result:
The same results as in the source code posted in 
mcrypt_module_open() i.e. the original string.

Actual result:
Garbled output that varies with each new call.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-02 03:31 UTC]
This is not a bug at all; you HAVE to use the same IV for both encrypting and decrypting otherwise the algorithm is pointed in the wrong way. The reason why it works with ECB is because that is the only mode not using an IV.

See also:
and further slides, and
 [2004-03-02 14:51 UTC] robert at peakepro dot com
Thanks for the quick reply. I'll look into this and 
ammend my contribution to the manual as appropriate. I'm 
guessing if this wasn't clear to me it may not have been 
clear to a lot of people.
 [2004-03-02 14:57 UTC]
Yup, it's something mistaken by a lot of people. (I set the status back to bogus, as this is not a bug in PHP).
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Wed Mar 22 23:04:45 2023 UTC