[openssl/openssl] 119ab9: Check the tag on EVP_Cipher() finalize: Poly1305 a...

  Branch: refs/heads/openssl-3.0
  Home:   https://github.com/openssl/openssl
  Commit: 119ab9555dc62275bbd71f6f49529b1a44feba42
      https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42
  Author: Billy Brumley <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_ocb.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.c

  Log Message:
  -----------
  Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs

For the affected OpenSSL built-in provider AEAD implementations,
EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a
NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit
on an empty message, with or without AAD, and returned success without
comparing an explicitly supplied tag. Consequently a corrupted tag was
accepted before this change.

Make these built-in callbacks perform their terminal tag operation,
aligning their explicit-tag handling with the streaming Final path
without defining NULL input as part of the generic EVP_Cipher()
contract.

AES-GCM-SIV also failed to generate a tag when Final was its first
empty-message operation. Generate the tag in that case and propagate
failures from the matching empty-message decrypt operation.

The stable ChaCha20-Poly1305 implementation aliases Update to the
one-shot cipher callback, so this backport introduces a dedicated Update
callback to preserve zero-length Update as a no-op.

Follow-up to #31555
Fixes #32258
Fixes CVE-2026-75803

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol

(cherry picked from commit 5741d29a5f356e05262cd0936a472a9961398d53)

Co-authored-by: Mounir IDRASSI <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 17:43:24 2026
Merged-from: https://github.com/openssl/openssl/pull/32417


  Commit: 2d17f2d7c0aa02e4e984dbf47d754d5d3defdf54
      https://github.com/openssl/openssl/commit/2d17f2d7c0aa02e4e984dbf47d754d5d3defdf54
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-19 (Wed, 19 Aug 2026)

  Changed paths:
    M test/evp_extra_test.c

  Log Message:
  -----------
  Add tests for empty AEAD EVP_Cipher() finalization

Generate an empty-message tag with the streaming path, then check that
EVP_Cipher() decryption accepts the correct tag and rejects a corrupted
one. Also verify that EVP_Cipher() encryption produces the same tag.

Cover AES-OCB and ChaCha20-Poly1305, with and without AAD.

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 17:43:25 2026
Merged-from: https://github.com/openssl/openssl/pull/32417


Compare: https://github.com/openssl/openssl/compare/39488cb86307...2d17f2d7c0aa

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.0/39488c-2d17f2%40github.com.