ping

Hello everyone,

in GCM and OCB mode, it is possible to set the authentication tag after
supplying AAD, but the CCM implementation does not allow that. This
isn't a problem for most applications, but in Node.js, we expose similar
APIs to interact with AEAD ciphers and these differences between cipher
modes within OpenSSL propagate to our users. Unless there is a reason
for the current behavior, I would prefer to change it.

I opened a PR about this five months ago
(#7243). It has received zero
attention and I am hoping the mailing list is a good way to change that.

Kind regards,
Tobias

(see https://mta.openssl.org/pipermail/openssl-users/2019-February/009881.html)

@mattcaswell Thank you for reviewing! I fixed the indentation issue, but I'll have to take a look at the documentation.

@blaufish Thank you for reviewing as well!

GCM and OCB also support to set the tag at any point before the call
to `EVP_*Final`, but this won't work for CCM due to a restriction
imposed by section 2.6 of RFC3610: The tag must be set before
actually decrypting data.

Does RFC3610 2.6 say anything specific on this subject?

Are you referring to this advice?

The recipient MUST verify the CBC-MAC before releasing any
information such as the plaintext.  If the CBC-MAC verification
fails, the receiver MUST destroy all information, except for the fact
that the CBC-MAC verification failed.

Yes, I am. I agree that the commit message might be a bit inaccurate there, I meant "releasing any information such as the plaintext" when I wrote "decrypting data".

It seems like good advice for any AEAD mode, and doesn't explicitly talk about in which order tag,aad,ciphertext is provided to aead-decrypt operations?

As per 2.2, before decryption can start:

* length(nonce)

* length(AAD)

* length(message)

These are needed due to CBC.MAC operations needs first block B_0 calculations.

As far as I know, there's nothing in the RFC about when tag needs to be provided, except that tag length must be known prior to decrypt finalising (releasing plaintext to caller).

That is correct, but the tag is required before providing the plaintext to the user, meaning it needs to be provided before decrypting data using EVP_CipherUpdate. And that should be exactly what this commit does, instead of unnecessarily requring it before AAD is passed.

I think the EVP_EncryptInit man page could do with some update as part of this PR to clarify when exactly the tag can be set.

@mattcaswell I added a few lines to the documentation, I assume that's what this has been waiting for. Please take another look.

Ping @openssl for second review.

Pushed. Thanks.