[openssl/openssl] 97fada: CCM: authenticate empty Final when payload Update ...
"'Mounir IDRASSI' via openssl-commits" <[email protected]>
| Newsgroups | gmane.comp.encryption.openssl.cvs |
|---|---|
| Message-ID | <openssl/openssl/push/refs/heads/master/[email protected]> |
Branch: refs/heads/master
Home: https://github.com/openssl/openssl
Commit: 97fada9e5243a5044a073226fe0894b287040525
https://github.com/openssl/openssl/commit/97fada9e5243a5044a073226fe0894b287040525
Author: Mounir IDRASSI <[email protected]>
Date: 2026-08-21 (Fri, 21 Aug 2026)
Changed paths:
M providers/implementations/ciphers/ciphercommon_ccm.c
M test/evp_extra_test.c
Log Message:
-----------
CCM: authenticate empty Final when payload Update is skipped
CCM Final was routed through an update helper whose pointer-based
dispatch treats a NULL-input call as a no-op or a length declaration.
If an empty message skips payload Update, decryption can therefore skip
tag verification and encryption does not generate a tag.
Process an empty payload during Final only when the existing state flags
show that no payload operation took place. Route the NULL-input
EVP_Cipher() form through the same Final path.
Enable CCM in the generic zero-length AEAD test. Declare the zero payload
length and supply AAD while deliberately omitting payload Update.
Fixes #32253
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Fri Aug 21 08:51:03 2026
Merged-from: https://github.com/openssl/openssl/pull/32256
To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications
--
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/292447-97fada%40github.com.