diff options
| author | slontis <shane.lontis@oracle.com> | 2023-01-27 13:18:17 +1000 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2023-01-30 09:50:14 +0100 |
| commit | 39bc59bc83c49c9313bfaa902a5e1d31848011e2 (patch) | |
| tree | d4cd96fe994b6b8e4993e70b658e2fdc1cd30b5a /doc | |
| parent | da6d4180526e5f6a03ecaae46a2bf9841eea44c6 (diff) | |
ChaCha20-Poly1305 no longer supports truncated IV's.
Fixes #20084
In the 3.0 provider implementation the generic code that handles IV's
only allows a 12 byte IV. Older code intentionally added the ability for
the IV to be truncated.
As this truncation is unsafe, the documentation has been updated to
state that this in no longer allowed. The code has been updated to
produce an error when the iv length is set to any value other than 12.
NOTE: It appears that this additional padding may have originated from the code
which uses a 12 byte IV, that is then passed to CHACHA which zero pads it to 16 bytes.
Note that legacy behaviour in e_chacha20_poly1305.c has not been
updated.
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20151)
(cherry picked from commit a01152370676e7e11fb461cff8628eb50fa41b81)
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/man3/EVP_EncryptInit.pod | 9 | ||||
| -rw-r--r-- | doc/man7/migration_guide.pod | 8 |
2 files changed, 12 insertions, 5 deletions
diff --git a/doc/man3/EVP_EncryptInit.pod b/doc/man3/EVP_EncryptInit.pod index ca203d3f4a..811b470543 100644 --- a/doc/man3/EVP_EncryptInit.pod +++ b/doc/man3/EVP_EncryptInit.pod @@ -1415,11 +1415,10 @@ The following I<ctrl>s are supported for the ChaCha20-Poly1305 AEAD algorithm. =item EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, ivlen, NULL) -Sets the nonce length. This call can only be made before specifying the nonce. -If not called a default nonce length of 12 (i.e. 96 bits) is used. The maximum -nonce length is 12 bytes (i.e. 96-bits). If a nonce of less than 12 bytes is set -then the nonce is automatically padded with leading 0 bytes to make it 12 bytes -in length. +Sets the nonce length. This call is now redundant since the only valid value +is the default length of 12 (i.e. 96 bits). +Prior to OpenSSL 3.0 a nonce of less than 12 bytes could be used to automatically +pad the iv with leading 0 bytes to make it 12 bytes in length. =item EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen, tag) diff --git a/doc/man7/migration_guide.pod b/doc/man7/migration_guide.pod index bcaa1b3a2a..c1d3e6f703 100644 --- a/doc/man7/migration_guide.pod +++ b/doc/man7/migration_guide.pod @@ -472,6 +472,14 @@ The function code part of the error code is now always set to 0. For that reason the ERR_GET_FUNC() macro was removed. Applications must resolve the error codes only using the library number and the reason code. +=head4 ChaCha20-Poly1305 cipher does not allow a truncated IV length to be used + +In OpenSSL 3.0 setting the IV length to any value other than 12 will result in an +error. +Prior to OpenSSL 3.0 the ivlen could be smaller that the required 12 byte length, +using EVP_CIPHER_CTX_ctrl(ctx, EVP_CRTL_AEAD_SET_IVLEN, ivlen, NULL). This resulted +in an IV that had leading zero padding. + =head2 Installation and Compilation Please refer to the INSTALL.md file in the top of the distribution for |