Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:48325 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 29487 invoked from network); 18 May 2010 21:17:55 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 18 May 2010 21:17:55 -0000 X-Host-Fingerprint: 209.131.62.146 nat-dip11.cfw-b-gci.corp.yahoo.com Received: from [209.131.62.146] ([209.131.62.146:6320] helo=localhost.localdomain) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id A8/40-27340-20403FB4 for ; Tue, 18 May 2010 17:17:54 -0400 Message-ID: To: internals@lists.php.net Date: Tue, 18 May 2010 14:17:51 -0700 User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Posted-By: 209.131.62.146 Subject: Re: [PHP-DEV] openssl_(en|de)crypt missing IV From: pollita@php.net (Sara Golemon) >> Fixing this is a simple matter, but I wanted to bounce approaches for BC (or >> lack thereof) off everyone else since this version of openssl_encrypt() is >> already "in the wild". > >> I think it's worth a BC break. Comments? > > To break BC is a no go, even if your arguments are appealing (even in > a major version). > I disagree about it's no-go-ness, given the fact that these functions aren't particularly usable as-is, but it's also not worth a fight. Given the comments made on list my intentions are as follows: 1) Add $iv as a fifth, optional parameter to openssl_(en|de)crypt() 2) Throw a warning if openssl_encrypt() is used without an IV 3) Add openssl_cipher_get_iv_length($cipher) I intend to make these changes on both trunk and PHP_5_3 because, IMO, this is a bug, not merely a missing feature. The only BC break is the warning raised when using openssl_encrypt() without an IV. Given the extremely bad practice using a NULL IV represents, I think this is a reasonable course of action. -Sara