AEAD: EVP_CIPHER_CTX_iv_length is oblivious to EVP_CTRL_AEAD_SET_IVLEN

[Joran Dirk Greef]

For AEAD ciphers, EVP_CIPHER_CTX_iv_length() does not return the ctx's actual IV length, but the cipher's default IV length:

For example, changing a GCM cipher's IV length from 12 to 4 fails the assertion:

int iv_size = 4;
EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, iv_size, NULL)
assert(EVP_CIPHER_CTX_iv_length(ctx) == iv_size);

Is this a bug? Or should the documentation make this clear?

[Matt Caswell]

I'd see this as a documentation issue

[unityGame775]

Could you please comment more on this? Is it possible to change IV length with EVP_CTRL_AEAD_SET_IVLEN, or OPENSSL accept only 12-byte IVs?

[Matt Caswell]

Yes it is possible to change the IV length with EVP_CTRL_AEAD_SET_IVLEN for those modes that support it (GCM, CCM and OCB).

The original issue mentioned by this PR is actually fixed in #9231. We should consider backporting it to 1.1.1 (@slontis).

[Shane]

OK @mattcaswell - I will look at it tomorrow. We should fix this (It is currently just returning the default value in 1.1.1)

[unityGame775]

Just to check, on which version of OpenSSL it is possible to change the IVs for GCM mode?
Thanks a lot!

[Matt Caswell]

EVP_CTRL_AEAD_SET_IVLEN exists since OpenSSL 1.1.0. In 1.0.2 you can use EVP_CTRL_GCM_SET_IVLEN to do the same job.

[unityGame775]

Could you please provide me any golden vector with 16-byte IV length? Because, my C model is not matching with OpenSSL GCM, it will be so helpful for me.

[Matt Caswell]

Sorry...it doesn't look like we have one with that IV length in our test vectors.

[Shane]

If you have a look at CRYPTO_gcm128_setiv() you will see that it does a bit more work when len !=12..

I would check if you get the same result for larger ones (since it should do a similiar operation) on iv blocks of size 16
e.g:

Cipher = aes-128-gcm
Key = feffe9928665731c6d6a8f9467308308
IV = 9313225df88406e555909c5aff5269aa6a7a9538534f7da1e4c303d2a318a728c3c0c95156809539fcf0e2429a6b525416aedbf5a0de6a57a637b39b
AAD = feedfacedeadbeeffeedfacedeadbeefabaddad2
Tag = 619cc5aefffe0bfa462af43c1699d050
Plaintext = d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39
Ciphertext = 8ce24998625615b603a033aca13fb894be9112a5c3a211a8ba262a3cca7e2ca701e4a9a4fba43c90ccdcb281d48c7c6fd62875d2aca417034c34aee5

[Matt Caswell]

Fixed by #9499