blob: 501ffc29cd12a4ac9d99b1b722cb13fb90f31142 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
From b33e02d25316fdbef94da086b54541ce9e5fb699 Mon Sep 17 00:00:00 2001
From: Matej Kenda <matejken@gmail.com>
Date: Wed, 3 Jan 2024 20:13:57 +0100
Subject: [PATCH] fix(test): Use 96-bit IV with aes-256-gcm to fix (#4347):
I/O error: error:1C800066:Provider routines::cipher operation failed
Backport of upstream commit b33e02d25316fdbef94da086b54541ce9e5fb699
(included in pocoproject/poco release 1.13.1).
Upstream commit also removed an earlier mitigation comment added in
commit 111fe90dd91ad6dcf2a487b69706e90132d97c44; that earlier comment
never landed in the 1.12.x line, so this backport only carries the
IV-size change and the new explanatory comment.
The CI workflow change in the upstream commit is dropped: it removed
the macOS-only EXCLUDE_TESTS entry that was added in 111fe90d, but
neither change applies to the 1.12.x line.
This change avoids the failing path entirely on OpenSSL 3 by using the
GCM-recommended 12-byte IV (matches EVP_CIPHER_iv_length for aes-256-gcm),
so the broken init order in CryptoTransformImpl is not exercised.
The underlying init-order issue in CipherImpl.cpp remains and is being
discussed with upstream separately.
---
Crypto/testsuite/src/CryptoTest.cpp | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/Crypto/testsuite/src/CryptoTest.cpp b/Crypto/testsuite/src/CryptoTest.cpp
--- a/Crypto/testsuite/src/CryptoTest.cpp
+++ b/Crypto/testsuite/src/CryptoTest.cpp
@@ -213,7 +213,10 @@ void CryptoTest::testEncryptDecryptGCM()
{
CipherKey key("aes-256-gcm");
- CipherKey::ByteVec iv(20, 213);
+ // 96-bit (12 byte) IV is recommended for usage with GCM.
+ // https://crypto.stackexchange.com/questions/41601/aes-gcm-recommended-iv-size-why-12-bytes
+
+ CipherKey::ByteVec iv(12, 213);
key.setIV(iv);
Cipher::Ptr pCipher = CipherFactory::defaultFactory().createCipher(key);
--
2.49.0
|
