php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Sec Bug #55244 openssl_encrypt() / openssl_decrypt() truncate keys
Submitted: 2011-07-19 18:20 UTC Modified: 2011-07-23 21:01 UTC
From: scottmac@php.net Assigned: scottmac (profile)
Status: Closed Package: OpenSSL related
PHP Version: Irrelevant OS: All
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: scottmac@php.net
New email:
PHP Version: OS:

 

 [2011-07-19 18:20 UTC] scottmac@php.net 
Description:
------------
The key length for variable length ciphers will always be the OpenSSL default. The 
larger key is just truncated. This makes our encryption algorithms incompatible 
with others implementations unless it happens to match the OpenSSL default.

Expected result:
----------------
mcrypt / openssl output to match with a 56 byte key using blowfish

Actual result:
--------------
Only matches with a 16 byte key, larger one produces different results.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-07-19 18:20 UTC] scottmac@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: scottmac
 [2011-07-19 18:20 UTC] scottmac@php.net 
This was fixed in 313453
 [2011-07-23 21:01 UTC] scottmac@php.net 
applied for a CVE still nothing.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Wed Apr 24 03:01:29 2024 UTC