Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87952
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.178 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
Date: Sun, 30 Aug 2015 20:10:30 +0100
Message-ID: <CAEKnhAF4DZ45_nku8GoRo1s=1ni1M-8krVyqc2FT0-6macH0Mw@mail.gmail.com>
To: PHP internals list <internals@lists.php.net>, Ferenc Kovacs <tyra3l@gmail.com>, 
	Anatol Belski <anatol.php@belski.net>, Pierre Joye <pierre.php@gmail.com>
Content-Type: multipart/alternative; boundary=001a113f905a0948e8051e8c1233
Subject: openssl_seal new param
From: bukka@php.net (Jakub Zelenka)

--001a113f905a0948e8051e8c1233
Content-Type: text/plain; charset=UTF-8

Hi,

I have been looking to https://bugs.php.net/bug.php?id=60632 which is about
failing (segfaulting) openssl_seal when used with cipher alg that requires
IV (e.g. AES-128-CBC). I think that the patch looks reasonable from the
quick look.

The only question and the reason why I'm sending this here is if everyone
(and mainly Ferenc ) is ok with adding new ref arg to openssl_seal that
will return iv to 5.6? So the definition is:

int openssl_seal ( string $data , string &$sealed_data , array &$env_keys ,
array $pub_key_ids [, string $method[, string &$iv ]] )

(the last iv is new). There would be also a new param for openssl_open that
would allow to pass that IV for opening sealed data.

Alternatively we could just disable IV ciphers in 5.6 to at least prevent
the segfault and add it to 7 if Anatol and Kalle are ok with that or 7.1 if
not :) ?

There also is an another thing for TS Win build (probably question for
Anatol and Pierre :) ). The thing is that EVP_SealInit uses internally
RAND_bytes. IIRC there is some locking issue with openssl RAND on TS win (
the reason why openssl_random_pseudo_bytes uses Win random) so I was
wondering if it should be disabled on win? The thing is that it is already
a case for other functions. One example is generating key params in
openssl_pkey_new:

openssl_pkey_new(array( 'dh'=> array( 'p' => $bin_prime, 'g' => '2' )));

This will also call RAND_bytes when generating priv key.

Could that be an issue on Win?

Cheers

Jakub

--001a113f905a0948e8051e8c1233--