Skip to content

Commit 8ebc8fc

Browse files
jordikroonjordikroon
committed
Update tests and introduce aad_supports_vector
1 parent ca12f45 commit 8ebc8fc

File tree

7 files changed

+155
-94
lines changed

7 files changed

+155
-94
lines changed

‎ext/openssl/openssl_backend_common.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1644,6 +1644,7 @@ void php_openssl_load_cipher_mode(struct php_openssl_cipher_mode *mode, const EV
16441644
/* We check for EVP_CIPH_SIV_MODE and EVP_CIPH_SIV_MODE, because LibreSSL does not support it. */
16451645
#ifdef EVP_CIPH_SIV_MODE
16461646
case EVP_CIPH_SIV_MODE:
1647+
mode->aad_supports_vector = true;
16471648
#endif
16481649
#ifdef EVP_CIPH_OCB_MODE
16491650
case EVP_CIPH_OCB_MODE:
@@ -1795,6 +1796,12 @@ zend_result php_openssl_cipher_update(const EVP_CIPHER *cipher_type,
17951796
{
17961797
int i = 0;
17971798

1799+
/* For AEAD modes that do not support vector AAD, treat NULL AAD as zero-length AAD */
1800+
if (!mode->aad_supports_vector && aad == NULL) {
1801+
aad_len = 0;
1802+
aad = "";
1803+
}
1804+
17981805
if (mode->is_single_run_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) {
17991806
php_openssl_store_errors();
18001807
php_error_docref(NULL, E_WARNING, "Setting of data length failed");

‎ext/openssl/php_openssl_backend.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,7 @@ struct php_openssl_cipher_mode {
348348
bool is_single_run_aead;
349349
bool set_tag_length_always;
350350
bool set_tag_length_when_encrypting;
351+
bool aad_supports_vector;
351352
int aead_get_tag_flag;
352353
int aead_set_tag_flag;
353354
int aead_ivlen_flag;

‎ext/openssl/tests/cipher_tests.inc‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,59 @@ $php_openssl_cipher_tests = array(
160160
'ct' => '1792A4E31E0755FB03E31B22116E6C2DDF9EFD6E33D536F1A0124B0A55BAE884ED93481529C76B6A',
161161
),
162162
),
163+
'aes-128-siv' => array(
164+
array(
165+
'key' => 'fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0' .
166+
'0f0e0d0c0b0a09080706050403020100',
167+
'iv' => '',
168+
'aad' => '',
169+
'tag' => 'baba5b99dfc42fa9810fb2eb71ac2e9c',
170+
'pt' => 'b1677d933fa706f7ef349f9dd569c028' .
171+
'279a5e2219728e77cfe916d5db979942' .
172+
'5d8fb93b0e26dbc85ed14c050dc9f054' .
173+
'd9153c2be1e9b99ae7a109aba1e5a7f1' .
174+
'f2131786da90fe998d3571c144d066c3',
175+
'ct' => '91416054151e844965ad20a2057e2baa' .
176+
'0e785269b152ba9d4dc834777e0d5376' .
177+
'db611856ae0d5d826f446c8eef47acb4' .
178+
'83dccb37da9481648a4907fd3d65335b' .
179+
'd9585361c0c1834ac2b975f3238ea7c6',
180+
),
181+
array(
182+
'key' => 'fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0' .
183+
'0f0e0d0c0b0a09080706050403020100',
184+
'iv' => '',
185+
'aad' => null,
186+
'tag' => '606ac96568128a278b02e3e04de97b7e',
187+
'pt' => 'ea597a2f9fb0b5c4d5a6f215047b58a3' .
188+
'3d2c885bf67cbb09239239f5aecafd6f' .
189+
'd2401391154b024b05cd938b40fdc749' .
190+
'ebccb3f48a3156c0bad69cfc5035360d' .
191+
'21ad626dc866cc539f2d0e34b6824fc3',
192+
'ct' => '9c75fa0345b35e2d6cbcc91ed3fc7feb' .
193+
'84fea50c35766db0c847fb627385107b' .
194+
'4f257548d8b80ccd04261fa651fb89cc' .
195+
'e6815ecf0c8c4586ce68544ddce4c3af' .
196+
'01e9587282256569194b1dca788fd987',
197+
),
198+
array(
199+
'key' => 'fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0' .
200+
'0f0e0d0c0b0a09080706050403020100',
201+
'iv' => '',
202+
'aad' => 'c0ef488e684e6fc95e0bd1da59861259',
203+
'tag' => 'a24cd6dcc0791bd7719a7f4fcb16de81',
204+
'pt' => 'b1677d933fa706f7ef349f9dd569c028' .
205+
'279a5e2219728e77cfe916d5db979942' .
206+
'5d8fb93b0e26dbc85ed14c050dc9f054' .
207+
'd9153c2be1e9b99ae7a109aba1e5a7f1' .
208+
'f2131786da90fe998d3571c144d066c3',
209+
'ct' => 'ea597a2f9fb0b5c4d5a6f215047b58a3' .
210+
'3d2c885bf67cbb09239239f5aecafd6f' .
211+
'd2401391154b024b05cd938b40fdc749' .
212+
'ebccb3f48a3156c0bad69cfc5035360d' .
213+
'21ad626dc866cc539f2d0e34b6824fc3',
214+
),
215+
),
163216
'chacha20-poly1305' => array(
164217
array(
165218
'key' => '808182838485868788898a8b8c8d8e8f' .

‎ext/openssl/tests/gh20851_aad_empty.phpt‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎ext/openssl/tests/gh20851_aad_null.phpt‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎ext/openssl/tests/openssl_decrypt_siv.phpt‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
--TEST--
2+
openssl_decrypt() with SIV cipher algorithm tests
3+
--EXTENSIONS--
4+
openssl
5+
--SKIPIF--
6+
<?php
7+
if (!in_array('aes-128-siv', openssl_get_cipher_methods()))
8+
die("skip: aes-128-siv not available");
9+
?>
10+
--FILE--
11+
<?php
12+
require_once __DIR__ . "/cipher_tests.inc";
13+
$method = 'aes-128-siv';
14+
$tests = openssl_get_cipher_tests($method);
15+
16+
foreach ($tests as $idx => $test) {
17+
echo "TEST $idx\n";
18+
$pt = openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
19+
$test['iv'], $test['tag'], $test['aad']);
20+
var_dump($test['pt'] === $pt);
21+
}
22+
23+
// failed because no AAD
24+
echo "TEST AAD\n";
25+
var_dump(openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
26+
$test['iv'], $test['tag']));
27+
// failed because wrong tag
28+
echo "TEST WRONGTAG\n";
29+
var_dump(openssl_decrypt($test['ct'], $method, $test['key'], OPENSSL_RAW_DATA,
30+
$test['iv'], str_repeat('x', 16), $test['aad']));
31+
32+
?>
33+
--EXPECTF--
34+
TEST 0
35+
bool(true)
36+
TEST 1
37+
bool(true)
38+
TEST 2
39+
bool(true)
40+
TEST AAD
41+
bool(false)
42+
TEST WRONGTAG
43+
bool(false)

‎ext/openssl/tests/openssl_encrypt_siv.phpt‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
openssl_encrypt() with SIV cipher algorithm tests
3+
--EXTENSIONS--
4+
openssl
5+
--SKIPIF--
6+
<?php
7+
if (!in_array('aes-128-siv', openssl_get_cipher_methods()))
8+
die("skip: aes-128-siv not available");
9+
?>
10+
--FILE--
11+
<?php
12+
require_once __DIR__ . "/cipher_tests.inc";
13+
$method = 'aes-128-siv';
14+
$tests = openssl_get_cipher_tests($method);
15+
16+
foreach ($tests as $idx => $test) {
17+
echo "TEST $idx\n";
18+
$ct = openssl_encrypt($test['pt'], $method, $test['key'], OPENSSL_RAW_DATA,
19+
$test['iv'], $tag, $test['aad'], strlen($test['tag']));
20+
var_dump($test['ct'] === $ct);
21+
var_dump($test['tag'] === $tag);
22+
}
23+
24+
// Empty tag should not be equivalent to null tag
25+
echo "TEST AAD\n";
26+
var_dump(openssl_encrypt('data', $method, 'password', 0, '', $tag, '') !== openssl_encrypt('data', $method, 'password', 0, '', $tag, null));
27+
28+
// Failing to retrieve tag (max is 16 bytes)
29+
var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 32), $tag, '', 20));
30+
31+
// Failing when no tag supplied
32+
var_dump(openssl_encrypt('data', $method, 'password', 0, str_repeat('x', 32)));
33+
?>
34+
--EXPECTF--
35+
TEST 0
36+
bool(true)
37+
bool(true)
38+
TEST 1
39+
bool(true)
40+
bool(true)
41+
TEST 2
42+
bool(true)
43+
bool(true)
44+
TEST AAD
45+
bool(true)
46+
47+
Warning: openssl_encrypt(): Retrieving verification tag failed in %s on line %d
48+
bool(false)
49+
50+
Warning: openssl_encrypt(): A tag should be provided when using AEAD mode in %s on line %d
51+
bool(false)

0 commit comments

Comments
 (0)