Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:90200
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.181 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEKnhAFFazCoVct5gMs9NGAUwWm6YEDY2+j2HDhr8k2U=QwMiA@mail.gmail.com>
References: <CAEKnhAHGK0Uj-nGyGGXWXS1jE6P+nqLgLMJjje3pyT78hVUBLA@mail.gmail.com>
 <CAEYWF=7tMegJ9GDA8ZQBpybp6JNec65-hF+j1Z=X_UxY_i5Z7Q@mail.gmail.com> <CAEKnhAFFazCoVct5gMs9NGAUwWm6YEDY2+j2HDhr8k2U=QwMiA@mail.gmail.com>
Date: Wed, 6 Jan 2016 18:17:36 +0200
Message-ID: <CAMA5aFZ1oh=C_P8LD5V-KnembR9mi9OdsCSjEmhr5KVH7UPGYw@mail.gmail.com>
To: Jakub Zelenka <bukka@php.net>
Cc: Bishop Bettini <bishop@php.net>, Scott Arciszewski <scott@paragonie.com>, 
	PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113f8f3a629d550528acb2ae
Subject: Re: [PHP-DEV] [RFC] OpenSSL AEAD support
From: albertcasademont@gmail.com (Albert Casademont)

--001a113f8f3a629d550528acb2ae
Content-Type: text/plain; charset=UTF-8

+1 thanks Jakub!

On Wed, Jan 6, 2016 at 6:09 PM, Jakub Zelenka <bukka@php.net> wrote:

> Hi,
>
> On Wed, Jan 6, 2016 at 3:35 PM, Bishop Bettini <bishop@php.net> wrote:
>
> > Hi Jakub,
> >
> > On Wed, Jan 6, 2016 at 10:01 AM, Jakub Zelenka <bukka@php.net> wrote:
> >>
> >> https://wiki.php.net/rfc/openssl_aead
> >
> >
> > I think the API might need to be more generic so that any future cipher
> > modes with different parameters could also be passed in.
> >
> > The reference model I'd suggest is the "context" parameter passed to
> > stream related-functions.  Userland creates a context, then passes the
> > context to the encrypt/decrypt functions. The context is specific to the
> > wrapper and drives specific behavior. Encrypt can add to the context any
> > specific cipher state that needs to be passed along to decrypt.
> >
> > Using this model, the openssl API might look like:
> >
> > $context = openssl_context_create([ 'aead' => [ 'aad' => '...',
> > 'tag_length' => '...' ]]);
> > $ciphertext = openssl_encrypt(
> >     $data, $method, $password, $options, $iv,
> >     $context // here is the new parameter, encapsulating all cipher
> > specifics
> > );
> >
> > echo $context['aead']['tag']; // populated by openssl_encrypt
> >
> > $plaintext = openssl_decrypt(
> >     $ciphertext, $method, $password, $options, $iv,
> >     $context // fully-reversible, because all necessary data are in
> context
> > );
> >
> >
> Please see note in https://wiki.php.net/rfc/openssl_aead#rejected_features
> . Any context related features will add a lot to the size of the
> implementation. In this case it would also mean introducing an object with
> dimension handler to the openssl ext which doesn't really match with the
> rest of the extension API. The proposed API is more conformant to the rest
> and the code addition is also limited which is very important from the
> maintenance point of view.
>
> I have got already an extension where you can do all of this context
> related stuff ( see https://github.com/bukka/php-crypto ) but I don't
> think
> that anything like this should be part of the openssl ext. I think we
> should concentrate on adding just the most important features with minimal
> code addition to openssl ext and also concentrate on the fixing the actual
> bugs. Bare in mind that all of this has to be maintained for very long time
> and when you look to the regular contributors to openssl ext, you won't see
> too many people...
>
> To sum it up this is a minimal proposal to add AEAD support to openssl ext.
> Anything context related is out of scope of this RFC.
>
> Cheers
>
> Jakub
>

--001a113f8f3a629d550528acb2ae--