Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81583
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.181 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAPwsocG-4vfT4PbC_0BG3QFzi0Ws-1anVCT-qynErnsj_pUG7w@mail.gmail.com>
References: <CAPwsocHXO4A+XH+-8uZJdJBBGW1wNrtneQ7ukbukKFoOXmVEtA@mail.gmail.com>
	<CAMU2igs_2itLWZsZBtGPBfT1Kj29fJyn4Tnmj_RLXn2TpOaZwg@mail.gmail.com>
	<CAPwsocFkbY75nUROFvFbO+YOoN4u9sa09ot8o_TrQOdp09r6_g@mail.gmail.com>
	<CAEKnhAGHmMCiHaQkDDdG5ukiJhB7it8KZGAF0Q-JuTd-udZtkg@mail.gmail.com>
	<CAPwsocHFweJhves+tU66GVKPjcO5kzFGZvzaaMg9cjCYJsgL1Q@mail.gmail.com>
	<CAPwsocG-4vfT4PbC_0BG3QFzi0Ws-1anVCT-qynErnsj_pUG7w@mail.gmail.com>
Date: Mon, 2 Feb 2015 04:46:38 -0700
Message-ID: <CAMU2iguFkC-SHvOoQG1rRUzJ-X4+3zudW1tVacnF+UoJqoVz+w@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: Jakub Zelenka <bukka@php.net>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1134a90ece796d050e19810d
Subject: Re: [PHP-DEV] OpenSSL ext. improvements for authenticated cipher modes.
From: jason.gerfen@gmail.com (Jason Gerfen)

--001a1134a90ece796d050e19810d
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Mon, Feb 2, 2015 at 3:58 AM, Leigh <leight@gmail.com> wrote:

> On 2 February 2015 at 10:57, Leigh <leight@gmail.com> wrote:
> > length (not sure how of
>
> Not sure how often tag lengths aside from 16 are used.
>

=E2=80=8B
According to documentation provided about the OCB mode of AES it says the
following:

Section 3: The scheme

> The tag length is an integer =CF=84 =E2=88=88 [0 .. n]. ... As for the ta=
g length, a
> suggested default of =CF=84 =3D 64 is reasonable. Tags of 32 bits are sta=
ndard in
> retail banking. Tags of 96 bits are used in IPSec. Using a tag of more th=
an
> 80 bits adds questionable security benefit, though it does lengthen each
> cipher text.
>

http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/ocb/ocb-=
spec.pdf

Maybe E_WARNING on any tag length less than 64 would also be useful in OCB
mode(s).

The GCM mode is somewhat different regarding the allowed tag length(s).

Section 5.2.1.2 Output Data

> The bit length of the tag, denoted t, is a security parameter, as
> discussed in Appendix B. In general, t may be any one of the following fi=
ve
> values: 128, 120, 112, 104, or 96. For certain applications, t may  be 64
> or 32; guidance for the use of these two tag lengths, including
> requirements on the length of the input data and the lifetime of the key =
in
> these cases, is given in Appendix C.
>

http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf

Tag lengths of 32 & 96 are common in lower level desktop based applications
as noted for IPSec & retail banking applications. I am not sure how common
these smaller tag lengths would apply to PHP, however, given the age of the
bug report compared to the age of the mode(s) requesting use of these
mode(s) doesn't seem to be common.
=E2=80=8B

--001a1134a90ece796d050e19810d--