php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77156 Useless warning for AEAD
Submitted: 2018-11-14 22:56 UTC Modified: 2021-02-03 12:10 UTC
Votes:5
Avg. Score:2.6 ± 1.5
Reproduced:4 of 4 (100.0%)
Same Version:2 (50.0%)
Same OS:2 (50.0%)
From: obreham at gmail dot com Assigned: cmb (profile)
Status: Closed Package: OpenSSL related
PHP Version: 7.1.24 OS: Windows
Private report: No CVE-ID: None
 [2018-11-14 22:56 UTC] obreham at gmail dot com
Description:
------------
PHP version: 7.1.9

The documentation for openssl_encrypt() indicates that the default &$tag = NULL, which should be true for any case.

But if a $tag is deliberately passed - even when set to NULL - with a cipher that does not support AEAD, a warning is triggered.  This warning is not even mentioned in the documentation.

There are no needs for this warning, especially when it is the default value (NULL).  The function does set the $tag to NULL (no matter its initial value) and the correct encrypted data is returned.  Nothing unexpected happens.

As an aside, there is also a typo in the error message, it should read "does not" and not "doesn not".

Test script:
---------------
$tag = null;
$encrypted = openssl_encrypt(
	'data',
	'aes-256-ctr',
	'password',
	0,
	'1234567812345467',
	$tag
);
var_dump($tag, $encrypted);

Expected result:
----------------
NULL
string(8) "/fQItQ=="

Actual result:
--------------
Warning:  openssl_encrypt(): The authenticated tag cannot be provided for cipher that doesn not support AEAD in C:\wamp\www\test\test.php on line 8

NULL
string(8) "/fQItQ=="

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-02-03 12:10 UTC] cmb@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-02-03 12:10 UTC] cmb@php.net
This has been fixed in the meantime:
<https://github.com/php/php-src/commit/6c6a58e930c5863ab1bd11f6a19cbf22aa2f20d4>.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 08:02:42 2024 UTC