|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Sec Bug #55244 openssl_encrypt() / openssl_decrypt() truncate keys
Submitted: 2011-07-19 18:20 UTC Modified: 2011-07-23 21:01 UTC
From: Assigned: scottmac (profile)
Status: Closed Package: OpenSSL related
PHP Version: Irrelevant OS: All
Private report: No CVE-ID: None
 [2011-07-19 18:20 UTC]
The key length for variable length ciphers will always be the OpenSSL default. The 
larger key is just truncated. This makes our encryption algorithms incompatible 
with others implementations unless it happens to match the OpenSSL default.

Expected result:
mcrypt / openssl output to match with a 56 byte key using blowfish

Actual result:
Only matches with a 16 byte key, larger one produces different results.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2011-07-19 18:20 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: scottmac
 [2011-07-19 18:20 UTC]
This was fixed in 313453
 [2011-07-23 21:01 UTC]
applied for a CVE still nothing.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Fri Jan 27 12:04:13 2023 UTC