Skip to content

Commit 344b75d

Browse files
jordikroonjordikroon
committed
allow null AAD parameter in openssl_encrypt/decrypt
1 parent 43c0a78 commit 344b75d

File tree

6 files changed

+64
-11
lines changed

6 files changed

+64
-11
lines changed

‎ext/openssl/openssl.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4531,7 +4531,7 @@ PHP_FUNCTION(openssl_encrypt)
45314531
zend_string *ret;
45324532
zval *tag = NULL;
45334533

4534-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|lszsl", &data, &data_len, &method, &method_len,
4534+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|lszs!l", &data, &data_len, &method, &method_len,
45354535
&password, &password_len, &options, &iv, &iv_len, &tag, &aad, &aad_len, &tag_len) == FAILURE) {
45364536
RETURN_THROWS();
45374537
}
@@ -4553,7 +4553,7 @@ PHP_FUNCTION(openssl_decrypt)
45534553
size_t data_len, method_len, password_len, iv_len = 0, tag_len = 0, aad_len = 0;
45544554
zend_string *ret;
45554555

4556-
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|lss!s", &data, &data_len, &method, &method_len,
4556+
if (zend_parse_parameters(ZEND_NUM_ARGS(), "sss|lss!s!", &data, &data_len, &method, &method_len,
45574557
&password, &password_len, &options, &iv, &iv_len, &tag, &tag_len, &aad, &aad_len) == FAILURE) {
45584558
RETURN_THROWS();
45594559
}

‎ext/openssl/openssl.stub.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -662,9 +662,9 @@ function openssl_digest(string $data, string $digest_algo, bool $binary = false)
662662
/**
663663
* @param string $tag
664664
*/
665-
function openssl_encrypt(#[\SensitiveParameter] string $data, string $cipher_algo, #[\SensitiveParameter] string $passphrase, int $options = 0, string $iv = "", &$tag = null, string $aad = "", int $tag_length = 16): string|false {}
665+
function openssl_encrypt(#[\SensitiveParameter] string $data, string $cipher_algo, #[\SensitiveParameter] string $passphrase, int $options = 0, string $iv = "", &$tag = null, ?string $aad = "", int $tag_length = 16): string|false {}
666666

667-
function openssl_decrypt(string $data, string $cipher_algo, #[\SensitiveParameter] string $passphrase, int $options = 0, string $iv = "", ?string $tag = null, string $aad = ""): string|false {}
667+
function openssl_decrypt(string $data, string $cipher_algo, #[\SensitiveParameter] string $passphrase, int $options = 0, string $iv = "", ?string $tag = null, ?string $aad = ""): string|false {}
668668

669669
function openssl_cipher_iv_length(string $cipher_algo): int|false {}
670670

‎ext/openssl/openssl_arginfo.h‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎ext/openssl/openssl_backend_common.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1816,7 +1816,9 @@ zend_result php_openssl_cipher_update(const EVP_CIPHER *cipher_type,
18161816
return FAILURE;
18171817
}
18181818

1819-
if (mode->is_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, (const unsigned char *) aad, (int) aad_len)) {
1819+
/* Only pass AAD to OpenSSL if caller provided it.
1820+
This makes NULL mean zero AAD items, while "" with len 0 means one empty AAD item. */
1821+
if (mode->is_aead && aad != NULL && !EVP_CipherUpdate(cipher_ctx, NULL, &i, (const unsigned char *)aad, (int)aad_len)) {
18201822
php_openssl_store_errors();
18211823
php_error_docref(NULL, E_WARNING, "Setting of additional application data failed");
18221824
return FAILURE;

ext/openssl/tests/gh20851.phpt renamed to ext/openssl/tests/gh20851_aad_empty.phpt

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ openssl
77
$algo = 'aes-256-siv';
88
$key = str_repeat('1', 64);
99
$tag = '';
10+
$aad = '';
1011
$input = 'Hello world!';
1112

1213
$ciphertext = openssl_encrypt(
@@ -15,7 +16,9 @@ $ciphertext = openssl_encrypt(
1516
$key,
1617
OPENSSL_RAW_DATA,
1718
'', // IV is empty for this cipher in PHP
18-
$tag // gets filled with the SIV
19+
$tag, // gets filled with the SIV
20+
$aad,
21+
16
1922
);
2023

2124
echo 'input: ' . $input . PHP_EOL;
@@ -29,7 +32,8 @@ $dec = openssl_decrypt(
2932
$key,
3033
OPENSSL_RAW_DATA,
3134
'',
32-
$tag
35+
$tag,
36+
$aad
3337
);
3438

3539
echo 'decrypted: ' . var_export($dec, true) . PHP_EOL;

‎ext/openssl/tests/gh20851_aad_null.phpt‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
--TEST--
2+
openssl: AES-256-SIV AEAD tag and AAD roundtrip
3+
--EXTENSIONS--
4+
openssl
5+
--FILE--
6+
<?php
7+
$algo = 'aes-256-siv';
8+
$key = str_repeat('1', 64);
9+
$tag = '';
10+
$aad = null;
11+
$input = 'Hello world!';
12+
13+
$ciphertext = openssl_encrypt(
14+
'Hello world!',
15+
$algo,
16+
$key,
17+
OPENSSL_RAW_DATA,
18+
'', // IV is empty for this cipher in PHP
19+
$tag, // gets filled with the SIV
20+
$aad,
21+
16
22+
);
23+
24+
echo 'input: ' . $input . PHP_EOL;
25+
echo 'tag: ' . bin2hex($tag) . PHP_EOL;
26+
echo 'ciphertext: ' . bin2hex($ciphertext) . PHP_EOL;
27+
echo 'combined: ' . bin2hex($tag . $ciphertext) . PHP_EOL;
28+
29+
$dec = openssl_decrypt(
30+
$ciphertext,
31+
$algo,
32+
$key,
33+
OPENSSL_RAW_DATA,
34+
'',
35+
$tag,
36+
$aad
37+
);
38+
39+
echo 'decrypted: ' . var_export($dec, true) . PHP_EOL;
40+
?>
41+
--EXPECTF--
42+
input: Hello world!
43+
tag: c06f0df087e2784c5560ce5d0b378311
44+
ciphertext: 72fffba74d7bc3ddcceeb6d1
45+
combined: c06f0df087e2784c5560ce5d0b37831172fffba74d7bc3ddcceeb6d1
46+
decrypted: 'Hello world!'
47+

0 commit comments

Comments
 (0)