|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2020-12-27 18:16 UTC] bukka@php.net
-Type: Bug
+Type: Documentation Problem
[2020-12-27 18:16 UTC] bukka@php.net
[2020-12-28 14:35 UTC] cmb@php.net
-Status: Open
+Status: Verified
-Assigned To:
+Assigned To: cmb
[2020-12-28 14:37 UTC] cmb@php.net
[2020-12-28 14:38 UTC] phpdocbot@php.net
[2020-12-28 14:38 UTC] phpdocbot@php.net
-Status: Verified
+Status: Closed
[2020-12-28 21:27 UTC] mumumu@php.net
[2020-12-28 21:30 UTC] phpdocbot@php.net
[2020-12-30 11:58 UTC] nikic@php.net
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Nov 09 17:00:01 2025 UTC |
Description: ------------ openssl_encrypt() is not verifying the key lenght for given ciphering method. it encrpts and decrypts even with empty key. it is not verifying the key in any mode even with aes-gcm have same problem Test script: --------------- $key=""; $plaintext = "message to be encrypted"; $cipher = "aes-128-cbc"; if (in_array($cipher, openssl_get_cipher_methods())) { $ivlen = openssl_cipher_iv_length($cipher); $iv = openssl_random_pseudo_bytes($ivlen); $ciphertext = openssl_encrypt($plaintext, $cipher, $key, $options=0, $iv); //store $cipher, $iv, and $tag for decryption later $original_plaintext = openssl_decrypt($ciphertext, $cipher, $key, $options=0, $iv); echo $original_plaintext."\n"; } Expected result: ---------------- it must throw error if key length is not enough or empty.