[openssl/openssl] 6c7aa6: Check the tag on EVP_Cipher() finalize: Poly1305 a...

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: 6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a
      https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a
  Author: Billy Brumley <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
    M providers/implementations/ciphers/cipher_aes_ocb.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.c

  Log Message:
  -----------
  Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs

For the affected OpenSSL built-in provider AEAD implementations,
EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a
NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit
on an empty message, with or without AAD, and returned success without
comparing an explicitly supplied tag. Consequently a corrupted tag was
accepted before this change.

Make these built-in callbacks perform their terminal tag operation,
aligning their explicit-tag handling with the streaming Final path
without defining NULL input as part of the generic EVP_Cipher()
contract.

AES-GCM-SIV also failed to generate a tag when Final was its first
empty-message operation. Generate the tag in that case and propagate
failures from the matching empty-message decrypt operation.

OpenSSL 4.0 already has a dedicated ChaCha20-Poly1305 Update callback,
so keep zero-length Update as a no-op there while allowing the
NULL-input ccipher call to perform the terminal tag operation.

Follow-up to #31555
Fixes #32258
Fixes CVE-2026-75803

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol

(cherry picked from commit 5741d29a5f356e05262cd0936a472a9961398d53)

Co-authored-by: Mounir IDRASSI <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 15:56:02 2026
Merged-from: https://github.com/openssl/openssl/pull/32300


  Commit: 14d058f2874d38969aa934d23d5d51050c2f2dca
      https://github.com/openssl/openssl/commit/14d058f2874d38969aa934d23d5d51050c2f2dca
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M test/evp_extra_test.c

  Log Message:
  -----------
  Add tests for empty AEAD EVP_Cipher() finalization

Generate an empty-message tag with the streaming path, then check that
EVP_Cipher() decryption accepts the correct tag and rejects a corrupted
one. Also verify that EVP_Cipher() encryption produces the same tag.

Cover AES-OCB, ChaCha20-Poly1305, and AES-GCM-SIV, with and without AAD.

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 15:56:03 2026
Merged-from: https://github.com/openssl/openssl/pull/32300


Compare: https://github.com/openssl/openssl/compare/caa4be55b678...14d058f2874d

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/caa4be-14d058%40github.com.