php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #31945 openssl_pkcs7_encrypt(), data interception is too easy
Submitted: 2005-02-12 08:45 UTC Modified: 2005-03-20 17:59 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: ungdi at hotmail dot com Assigned:
Status: No Feedback Package: OpenSSL related
PHP Version: 5.0.3 OS: Windows Server 2003
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
39 - 9 = ?
Subscribe to this entry?

 
 [2005-02-12 08:45 UTC] ungdi at hotmail dot com
Description:
------------
Currently, the openssl_pkcs7_encrypt() function as according to the documentation here: http://www.php.net/manual/en/function.openssl-pkcs7-encrypt.php

Requires that the unencrypted input be a file already on the file system. This forces any PHP program having to output any form submission contents (destined to be an encrypted S/MIME e-mail) into the file system before encryption. After encryption is complete, it will be necessary to delete the file from the disk.

This method makes it trivial to recover the unencrypted information from the file on the disk through an undelete command or access of the drive data. Also, this causes the function to expose the unencrypted data on the disk to the whole system temporarily. During this window where the data is being encrypted, after the unencrypted data has been written to a file, it allows other programs or users to access the file and its unencrypted contents making it trivial to intercept the data being encrypted.

The function should be made to allow a string/data to be passed directly to the function without going through the file system. By allowing direct passing of the string to be encrypted to the openssl_pkcs7_encrypt() function, this decreases the surface area (possibility) and time frame in which someone can recover/access the unencrypted information.

Reproduce code:
---------------
Not applicable.

Expected result:
----------------
Not applicable.

Actual result:
--------------
Not applicable.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-02-12 09:52 UTC] wez@php.net
We do just what the openssl utility does itself.
Please submit a patch that implements this feature, and we'll gladly apply it.
 [2005-03-20 17:59 UTC] sniper@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 25 07:01:31 2024 UTC