[openssl/openssl] 362125: Check the tag on EVP_Cipher() finalize: Poly1305 a...

  Branch: refs/heads/openssl-3.6
  Home:   https://github.com/openssl/openssl
  Commit: 3621257986e27e540bf96a11570929a6e5a9e05b
      https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b
  Author: Billy Brumley <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
    M providers/implementations/ciphers/cipher_aes_ocb.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.c.in

  Log Message:
  -----------
  Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs

For the affected OpenSSL built-in provider AEAD implementations,
EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a
NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit
on an empty message, with or without AAD, and returned success without
comparing an explicitly supplied tag. Consequently a corrupted tag was
accepted before this change.

Make these built-in callbacks perform their terminal tag operation,
aligning their explicit-tag handling with the streaming Final path
without defining NULL input as part of the generic EVP_Cipher()
contract.

AES-GCM-SIV also failed to generate a tag when Final was its first
empty-message operation. Generate the tag in that case and propagate
failures from the matching empty-message decrypt operation.

The stable ChaCha20-Poly1305 implementation aliases Update to the
one-shot cipher callback, so this backport introduces a dedicated Update
callback to preserve zero-length Update as a no-op.

Follow-up to #31555
Fixes #32258
Fixes CVE-2026-75803

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol

(cherry picked from commit 5741d29a5f356e05262cd0936a472a9961398d53)

Co-authored-by: Mounir IDRASSI <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 15:58:27 2026
Merged-from: https://github.com/openssl/openssl/pull/32259


  Commit: b51c9af53180a33959d847de610eb5af116892cd
      https://github.com/openssl/openssl/commit/b51c9af53180a33959d847de610eb5af116892cd
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M test/evp_extra_test.c

  Log Message:
  -----------
  Add tests for empty AEAD EVP_Cipher() finalization

Generate an empty-message tag with the streaming path, then check that
EVP_Cipher() decryption accepts the correct tag and rejects a corrupted
one. Also verify that EVP_Cipher() encryption produces the same tag.

Cover AES-OCB, ChaCha20-Poly1305, and AES-GCM-SIV, with and without AAD.

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 15:58:28 2026
Merged-from: https://github.com/openssl/openssl/pull/32259


Compare: https://github.com/openssl/openssl/compare/3517c9dd21f5...b51c9af53180

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.6/3517c9-b51c9a%40github.com.