Feature #8667

Unable to set OpenSSL GCM iv_length in Ruby

Added by Anonymous almost 5 years ago. Updated almost 2 years ago.

Target version:



In OpenSSL you are allowed to change the iv_length on an AES-BCM cipher. ( However
this was not implemented in the ruby-wrapper. Since I am a novice in C and
OpenSSL I think by no means my supplied patch is complete, it is a start
however. Maybe this missing function can be added to Ruby 2.0?

You can now set the iv_length using:

cipher ='aes-128-gcm').encrypt
cipher.iv_len = 16

An issue I already spotted is that OpenSSL sets the ivlen on the
cipher_data (snippet from OpenSSL crypto/evp/e_aes.c):
EVP_AES_GCM_CTX *gctx = c->cipher_data;
gctx->ivlen = arg;

and not the c->cipher->iv_len. So querying for the iv_len in ruby by using
cipher.iv_len will still report the default which is 12. Encryption however
is done correctly using the new iv-length. I tested it by comparing it to
results from other programming languages (Java and C#).

Regards Andres

ossl_set_iv_length.patch (1.25 KB) ossl_set_iv_length.patch Anonymous, 07/23/2013 08:02 AM
0001-Alternate-implementation-of-gcm-IV-length-support.patch (2.01 KB) 0001-Alternate-implementation-of-gcm-IV-length-support.patch against trunk dwaite (David Waite), 05/04/2014 06:31 PM

Related issues

Related to Ruby trunk - Feature #10420: Cannot set IV length to OpenSSL::CipherClosed


#1 [ruby-core:56112] Updated by drbrain (Eric Hodel) almost 5 years ago

  • Category set to ext/openssl
  • Status changed from Open to Assigned
  • Assignee set to MartinBosslet (Martin Bosslet)
  • ruby -v set to -

#2 [ruby-core:62365] Updated by dwaite (David Waite) about 4 years ago

Alternate patch which makes iv length changes implicit in iv= when using GCM.

This issue currently requires me to require a patched ruby for my software to run.

#3 Updated by zzak (Zachary Scott) about 3 years ago

  • Assignee changed from MartinBosslet (Martin Bosslet) to openssl

Without knowing what HAVE_AUTHENTICATED_ENCRYPTION is, I'm not really sure.. also we need a test for this.

#4 Updated by rhenium (Kazuki Yamaguchi) almost 2 years ago

  • Related to Feature #10420: Cannot set IV length to OpenSSL::Cipher added

#5 [ruby-core:76243] Updated by rhenium (Kazuki Yamaguchi) almost 2 years ago

  • Status changed from Assigned to Closed
  • Tracker changed from Bug to Feature

I think this is good to have. I thought about changing Cipher#iv= first, too, but I didn't because of the current (2.3) behavior of Cipher#iv=. Please see:

Also available in: Atom PDF