Commit fa9e6f7
crypto: Allow GCM ciphers to have a longer IV length
GCM cipher IV length can be >=1 bytes.
When not the default 12 bytes (96 bits) sets the IV length using
`EVP_CIPHER_CTX_ctrl` with type `EVP_CTRL_GCM_SET_IVLEN`
PR-URL: #6376
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>1 parent a4880b5 commit fa9e6f7
2 files changed
Lines changed: 315 additions & 24 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -3271,12 +3271,24 @@ void CipherBase::InitIv(const char* cipher_type, | |||
| 3271 | 3271 | /* OpenSSL versions up to 0.9.8l failed to return the correct | |
| 3272 | 3272 | iv_length (0) for ECB ciphers */ | |
| 3273 | 3273 | if (EVP_CIPHER_iv_length(cipher_) != iv_len && | |
| 3274 | - !(EVP_CIPHER_mode(cipher_) == EVP_CIPH_ECB_MODE && iv_len == 0)) { | ||
| 3274 | + !(EVP_CIPHER_mode(cipher_) == EVP_CIPH_ECB_MODE && iv_len == 0) && | ||
| 3275 | + !(EVP_CIPHER_mode(cipher_) == EVP_CIPH_GCM_MODE) && iv_len > 0) { | ||
| 3275 | 3276 | return env()->ThrowError("Invalid IV length"); | |
| 3276 | 3277 | } | |
| 3278 | + | ||
| 3277 | 3279 | EVP_CIPHER_CTX_init(&ctx_); | |
| 3278 | 3280 | const bool encrypt = (kind_ == kCipher); | |
| 3279 | 3281 | EVP_CipherInit_ex(&ctx_, cipher_, nullptr, nullptr, nullptr, encrypt); | |
| 3282 | + | ||
| 3283 | + /* Set IV length. Only required if GCM cipher and IV is not default iv. */ | ||
| 3284 | + if (EVP_CIPHER_mode(cipher_) == EVP_CIPH_GCM_MODE && | ||
| 3285 | + iv_len != EVP_CIPHER_iv_length(cipher_)) { | ||
| 3286 | + if (!EVP_CIPHER_CTX_ctrl(&ctx_, EVP_CTRL_GCM_SET_IVLEN, iv_len, nullptr)) { | ||
| 3287 | + EVP_CIPHER_CTX_cleanup(&ctx_); | ||
| 3288 | + return env()->ThrowError("Invalid IV length"); | ||
| 3289 | + } | ||
| 3290 | + } | ||
| 3291 | + | ||
| 3280 | 3292 | if (!EVP_CIPHER_CTX_set_key_length(&ctx_, key_len)) { | |
| 3281 | 3293 | EVP_CIPHER_CTX_cleanup(&ctx_); | |
| 3282 | 3294 | return env()->ThrowError("Invalid key length"); | |
0 commit comments