From: "Andrès Koetsier" <andres@...>
Date: 2013-07-19T19:32:24+09:00
Subject: [ruby-core:56085] Unable to set OpenSSL GCM iv_length in Ruby

--001a11c37cc486a68204e1dad797
Content-Type: multipart/alternative; boundary=001a11c37cc486a67804e1dad795

--001a11c37cc486a67804e1dad795
Content-Type: text/plain; charset=ISO-8859-1

Hello,

In OpenSSL you are allowed to change the iv_length on an AES-BCM cipher. (
http://www.openssl.org/docs/crypto/EVP_EncryptInit.html#GCM_Mode) However
this was not implemented in the ruby-wrapper. Since I am a novice in C and
OpenSSL I think by no means my supplied patch is complete, it is a start
however. Maybe this missing function can be added to Ruby 2.0?

You can now set the iv_length using:

cipher = OpenSSL::Cipher.new('aes-128-gcm').encrypt
cipher.iv_len = 16

An issue I already spotted is that OpenSSL sets the ivlen on the
cipher_data (snippet from OpenSSL crypto/evp/e_aes.c):
EVP_AES_GCM_CTX *gctx = c->cipher_data;
gctx->ivlen = arg;

and not the c->cipher->iv_len. So querying for the iv_len in ruby by using
cipher.iv_len will still report the default which is 12. Encryption however
is done correctly using the new iv-length. I tested it by comparing it to
results from other programming languages (Java and C#).

Regards Andres

--001a11c37cc486a67804e1dad795
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,<div><br></div><div>In OpenSSL you are allowed to ch=
ange the iv_length on an AES-BCM cipher. (<a href=3D"http://www.openssl.org=
/docs/crypto/EVP_EncryptInit.html#GCM_Mode">http://www.openssl.org/docs/cry=
pto/EVP_EncryptInit.html#GCM_Mode</a>)=A0However this was not implemented i=
n the ruby-wrapper. Since I am a novice in C and OpenSSL I think by no mean=
s my supplied patch is complete, it is a start however. Maybe this missing =
function can be added to Ruby 2.0?</div>
<div><br></div><div>You can now set the iv_length using:</div><div><br></di=
v><div><div>cipher =3D OpenSSL::Cipher.new(&#39;aes-128-gcm&#39;).encrypt</=
div><div>cipher.iv_len =3D 16</div></div><div><br></div><div>An issue I alr=
eady spotted is that OpenSSL sets the ivlen on the cipher_data (snippet fro=
m OpenSSL crypto/evp/e_aes.c):</div>
<div>EVP_AES_GCM_CTX *gctx =3D c-&gt;cipher_data;<br></div><div>gctx-&gt;iv=
len =3D arg;<br></div><div><br></div><div>and not the=A0c-&gt;cipher-&gt;iv=
_len. So querying for the iv_len in ruby by using cipher.iv_len will still =
report the default which is 12. Encryption however is done correctly using =
the new iv-length. I tested it by comparing it to results from other progra=
mming languages (Java and C#).</div>
<div><br></div><div>Regards Andres</div></div>

--001a11c37cc486a67804e1dad795--
--001a11c37cc486a68204e1dad797
Content-Type: application/octet-stream; name="ossl_set_iv_length.patch"
Content-Disposition: attachment; filename="ossl_set_iv_length.patch"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_hjb8lk4w0

SW5kZXg6IG9zc2xfY2lwaGVyLmMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gb3NzbF9jaXBoZXIuYwkocmV2aXNp
b24gNDIwNjQpCisrKyBvc3NsX2NpcGhlci5jCSh3b3JraW5nIGNvcHkpCkBAIC02NzcsNiArNjc3
LDI3IEBACiAgICAgcmV0dXJuIGtleV9sZW5ndGg7CiB9CiAKKy8qCisgKiAgY2FsbC1zZXE6Cisg
KiAgICAgY2lwaGVyLml2X2xlbiA9IGludGVnZXIgLT4gaW50ZWdlcgorICoKKyAqICBTZXRzIHRo
ZSBpdiBsZW5ndGggb2YgdGhlIGNpcGhlci4KKyAqCisgKiAgU2VlIEVWUF9DVFJMX0dDTV9TRVRf
SVZMRU4gZm9yIGZ1cnRoZXIgaW5mb3JtYXRpb24uCisgKi8KK3N0YXRpYyBWQUxVRQorb3NzbF9j
aXBoZXJfc2V0X2djbV9pdl9sZW5ndGgoVkFMVUUgc2VsZiwgVkFMVUUgaXZfbGVuZ3RoKQorewor
ICAgIGludCBpdmxlbiA9IE5VTTJJTlQoaXZfbGVuZ3RoKTsKKyAgICBFVlBfQ0lQSEVSX0NUWCAq
Y3R4OworCisgICAgR2V0Q2lwaGVyKHNlbGYsIGN0eCk7CisgICAgaWYgKEVWUF9DSVBIRVJfQ1RY
X2N0cmwoY3R4LCBFVlBfQ1RSTF9HQ01fU0VUX0lWTEVOLCBpdmxlbiwgTlVMTCkgIT0gMSkKKyAg
ICAgICAgb3NzbF9yYWlzZShlQ2lwaGVyRXJyb3IsIE5VTEwpOworCisgICAgcmV0dXJuIGl2X2xl
bmd0aDsKK30KKwogI2lmIGRlZmluZWQoSEFWRV9FVlBfQ0lQSEVSX0NUWF9TRVRfUEFERElORykK
IC8qCiAgKiAgY2FsbC1zZXE6CkBAIC05NjMsNiArOTg0LDcgQEAKICAgICByYl9kZWZpbmVfbWV0
aG9kKGNDaXBoZXIsICJrZXlfbGVuPSIsIG9zc2xfY2lwaGVyX3NldF9rZXlfbGVuZ3RoLCAxKTsK
ICAgICByYl9kZWZpbmVfbWV0aG9kKGNDaXBoZXIsICJrZXlfbGVuIiwgb3NzbF9jaXBoZXJfa2V5
X2xlbmd0aCwgMCk7CiAgICAgcmJfZGVmaW5lX21ldGhvZChjQ2lwaGVyLCAiaXY9Iiwgb3NzbF9j
aXBoZXJfc2V0X2l2LCAxKTsKKyAgICByYl9kZWZpbmVfbWV0aG9kKGNDaXBoZXIsICJpdl9sZW49
Iiwgb3NzbF9jaXBoZXJfc2V0X2djbV9pdl9sZW5ndGgsIDEpOwogICAgIHJiX2RlZmluZV9tZXRo
b2QoY0NpcGhlciwgIml2X2xlbiIsIG9zc2xfY2lwaGVyX2l2X2xlbmd0aCwgMCk7CiAgICAgcmJf
ZGVmaW5lX21ldGhvZChjQ2lwaGVyLCAiYmxvY2tfc2l6ZSIsIG9zc2xfY2lwaGVyX2Jsb2NrX3Np
emUsIDApOwogICAgIHJiX2RlZmluZV9tZXRob2QoY0NpcGhlciwgInBhZGRpbmc9Iiwgb3NzbF9j
aXBoZXJfc2V0X3BhZGRpbmcsIDEpOwo=
--001a11c37cc486a68204e1dad797--