|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #78628 AES-256-XTS cipher method does not work
Submitted: 2019-10-03 11:10 UTC Modified: 2019-12-08 18:47 UTC
From: Assigned:
Status: Open Package: OpenSSL related
PHP Version: 7.3.10 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
New email:
PHP Version: OS:


 [2019-10-03 11:10 UTC]
Tested with various PHP versions (7.3.9 and 7.4.0beta4 and some older 7.x) on Ubuntu 18.04. This originates from on of our users using PHP 7.3 on Debian Stable.

$php -r "print_r(openssl_get_cipher_methods());" | grep -i xts
    [12] => aes-128-xts
    [35] => aes-256-xts

However, if you see the test script openssl_enrypt() does not work, returns false. No error/warning. The same for AES-128-XTS.

I'm not sure what is expected from OpenSSL in the system, but `openssl ciphers -v | grep XTS` returns nothing.

Maybe that's not a bug, but I'd like to hear some explanation for this behavior.

Test script:
$iv = random_bytes(openssl_cipher_iv_length("aes-256-XTS"));
echo openssl_encrypt("test", "aes-256-XTS", "key", OPENSSL_RAW_DATA, $iv) === false;

Expected result:

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2019-10-04 11:06 UTC]
Additional info:
$ openssl list -cipher-algorithms | grep XTS
 [2019-12-01 19:44 UTC]
I think XTS needs a bit more handling so it's not fully supported. We could change this to the request to add support for it but wondering what the actual use case for XTS is in PHP world? It's mainly meant for disk encryption from what I know about this mode.
 [2019-12-02 09:07 UTC]
I don't really have a use-case, but documentation says that openssl_encrypt() accepts methods returned from openssl_get_cipher_methods(). No mention about some being not implemented or buggy.

The function throws E_WARNING in some cases, maybe that's another case for E_WARNING. Or maybe you have to just make it working.
 [2019-12-08 18:47 UTC]
-Type: Bug +Type: Documentation Problem
 [2019-12-08 18:47 UTC]
Yeah I think this is more documentation issue. Some ciphers require different handling so we shouldn't state that "penssl_encrypt() accepts methods returned from openssl_get_cipher_methods()". In a similar way chacha20-poly1305 doesn't work as AEAD - requested in .
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Jul 18 10:01:29 2024 UTC