[openssl/openssl] bf95f5: Check the tag on EVP_Cipher() finalize: Poly1305 a...

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: bf95f5f772e9362f87b25cfa2f8cb15d984865b9
      https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9
  Author: Billy Brumley <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
    M providers/implementations/ciphers/cipher_aes_ocb.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.c

  Log Message:
  -----------
  Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs

For the affected OpenSSL built-in provider AEAD implementations,
EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a
NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit
on an empty message, with or without AAD, and returned success without
comparing an explicitly supplied tag. Consequently a corrupted tag was
accepted before this change.

Make these built-in callbacks perform their terminal tag operation,
aligning their explicit-tag handling with the streaming Final path
without defining NULL input as part of the generic EVP_Cipher()
contract.

AES-GCM-SIV also failed to generate a tag when Final was its first
empty-message operation. Generate the tag in that case and propagate
failures from the matching empty-message decrypt operation.

The stable ChaCha20-Poly1305 implementation aliases Update to the
one-shot cipher callback, so this backport introduces a dedicated Update
callback to preserve zero-length Update as a no-op.

Follow-up to #31555
Fixes #32258
Fixes CVE-2026-75803

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol

(cherry picked from commit 5741d29a5f356e05262cd0936a472a9961398d53)

Co-authored-by: Mounir IDRASSI <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 17:41:16 2026
Merged-from: https://github.com/openssl/openssl/pull/32416


  Commit: 17aee36db64f351a62c6b3ff9f1e9560996a67e7
      https://github.com/openssl/openssl/commit/17aee36db64f351a62c6b3ff9f1e9560996a67e7
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M test/evp_extra_test.c

  Log Message:
  -----------
  Add tests for empty AEAD EVP_Cipher() finalization

Generate an empty-message tag with the streaming path, then check that
EVP_Cipher() decryption accepts the correct tag and rejects a corrupted
one. Also verify that EVP_Cipher() encryption produces the same tag.

Cover AES-OCB, ChaCha20-Poly1305, and AES-GCM-SIV, with and without AAD.

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 17:41:17 2026
Merged-from: https://github.com/openssl/openssl/pull/32416
(cherry picked from commit e9fb43aee8654b492ed8a239d3f2bacf13bb9081)


Compare: https://github.com/openssl/openssl/compare/de7d1871087f...17aee36db64f

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/de7d18-17aee3%40github.com.