Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81491
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAMU2igs_2itLWZsZBtGPBfT1Kj29fJyn4Tnmj_RLXn2TpOaZwg@mail.gmail.com>
References: <CAPwsocHXO4A+XH+-8uZJdJBBGW1wNrtneQ7ukbukKFoOXmVEtA@mail.gmail.com>
	<CAMU2igs_2itLWZsZBtGPBfT1Kj29fJyn4Tnmj_RLXn2TpOaZwg@mail.gmail.com>
Date: Sat, 31 Jan 2015 16:21:29 +0000
Message-ID: <CAPwsocFkbY75nUROFvFbO+YOoN4u9sa09ot8o_TrQOdp09r6_g@mail.gmail.com>
To: Jason Gerfen <jason.gerfen@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.
From: leight@gmail.com (Leigh)

On 31 January 2015 at 16:13, Jason Gerfen <jason.gerfen@gmail.com> wrote:
> On Sat, Jan 31, 2015 at 8:53 AM, Leigh <leight@gmail.com> wrote:
>> At the very basic end of the spectrum, we could have openssl_get_tag
>> and openssl_set_tag, or add an extra parameter to the end of
>> openssl_encrypt and openssl_decrypt (pass by ref for encrypt, like
>> preg $matches) this would cover the majority of use cases.
>>
>
> I think exposing this to the user will only cause confusion and allow users
> to implement mistakes to the algorithm and mode usage.
>

set/get tag functions are alto my least favourite options.

>
> According to the OpenSSL documentation regarding encryption/decryption using
> CCM, GCM & OCB modes for authenticated usage would require the additions of
> the following constants:
>
> EVP_CTRL_OCB_SET_TAGLEN
> EVP_CTRL_SET_IVLEN
> EVP_CTRL_GET_TAG
> EVP_CTRL_CCM_SET_L
> EVP_CTRL_CCM_SET_IVLEN
> EVP_aes_256_gcm()
> EVP_aes_128_gcm()
>
> That coupled with the use of the
>
> EVP_CIPHER_CTX_ctrl()
>
> should provide the needed functionality as described in
> http://wiki.openssl.org/index.php/EVP_Authenticated_Encryption_and_Decryption
> the documentation for using the EVP authenticated modes for
> encryption/decryption.
>

Thanks, I have done some cursory research into how it should be
implemented, but I wanted this discussion to be about how we should
present the functionality to the user. Implementation details can come
second once we have a consensus on what is/isn't too much, and what
method we should use to allow this functionality to be used.