Commit 6562444
crypto: allow GCM ciphers to have longer IV length
GCM cipher IV length can be >=1 bytes.
When not the default 12 bytes (96 bits) sets the IV length using
`EVP_CIPHER_CTX_ctrl` with type `EVP_CTRL_GCM_SET_IVLEN`
PR-URL: #6376
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>1 parent e9ff0f8 commit 6562444
2 files changed
Lines changed: 315 additions & 24 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3028,12 +3028,24 @@ void CipherBase::InitIv(const char* cipher_type, | |||
| 3028 | 3028 | /* OpenSSL versions up to 0.9.8l failed to return the correct | |
| 3029 | 3029 | iv_length (0) for ECB ciphers */ | |
| 3030 | 3030 | if (EVP_CIPHER_iv_length(cipher_) != iv_len && | |
| 3031 | - !(EVP_CIPHER_mode(cipher_) == EVP_CIPH_ECB_MODE && iv_len == 0)) { | ||
| 3031 | + !(EVP_CIPHER_mode(cipher_) == EVP_CIPH_ECB_MODE && iv_len == 0) && | ||
| 3032 | + !(EVP_CIPHER_mode(cipher_) == EVP_CIPH_GCM_MODE) && iv_len > 0) { | ||
| 3032 | 3033 | return env()->ThrowError("Invalid IV length"); | |
| 3033 | 3034 | } | |
| 3035 | + | ||
| 3034 | 3036 | EVP_CIPHER_CTX_init(&ctx_); | |
| 3035 | 3037 | const bool encrypt = (kind_ == kCipher); | |
| 3036 | 3038 | EVP_CipherInit_ex(&ctx_, cipher_, nullptr, nullptr, nullptr, encrypt); | |
| 3039 | + | ||
| 3040 | + /* Set IV length. Only required if GCM cipher and IV is not default iv. */ | ||
| 3041 | + if (EVP_CIPHER_mode(cipher_) == EVP_CIPH_GCM_MODE && | ||
| 3042 | + iv_len != EVP_CIPHER_iv_length(cipher_)) { | ||
| 3043 | + if (!EVP_CIPHER_CTX_ctrl(&ctx_, EVP_CTRL_GCM_SET_IVLEN, iv_len, nullptr)) { | ||
| 3044 | + EVP_CIPHER_CTX_cleanup(&ctx_); | ||
| 3045 | + return env()->ThrowError("Invalid IV length"); | ||
| 3046 | + } | ||
| 3047 | + } | ||
| 3048 | + | ||
| 3037 | 3049 | if (!EVP_CIPHER_CTX_set_key_length(&ctx_, key_len)) { | |
| 3038 | 3050 | EVP_CIPHER_CTX_cleanup(&ctx_); | |
| 3039 | 3051 | return env()->ThrowError("Invalid key length"); | |
0 commit comments