Skip to content

Fix break AES-128-CBC on Ruby 2.5.3. Change hard code 32 key len by cipher key len returned by OpenSSL. #18

Open
ntloi95 wants to merge 1 commit intochicks:masterfrom
ntloi95:master
Open

Fix break AES-128-CBC on Ruby 2.5.3. Change hard code 32 key len by cipher key len returned by OpenSSL. #18
ntloi95 wants to merge 1 commit intochicks:masterfrom
ntloi95:master

Conversation

@ntloi95
Copy link

@ntloi95 ntloi95 commented Oct 2, 2020

Regarding to the issue #17
Error in Ruby 2.5.3, set cipher.key: Exception “key must be 16 bytes"
OpenSSL::Cipher.new('AES-128-CBC') only accept key with length is 16 bytes.

While in the code, it return 32-byte-key with totally 16 trailing zero bytes:
@key.unpack('a2'*32).map{|x| x.hex}.pack('c'*32) => "o\xA8\xBB\a#'\xF8\xD0\xE4\v\x85\xFA\xD9\x05\x10\xF9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"

@ntloi95 ntloi95 changed the title Fix break on Ruby 2.5.3. Change hard code 32 key len by cipher key len return by OpenSSL. Fix break AES-128-CBC on Ruby 2.5.3. Change hard code 32 key len by cipher key len return by OpenSSL. Oct 2, 2020
@ntloi95 ntloi95 changed the title Fix break AES-128-CBC on Ruby 2.5.3. Change hard code 32 key len by cipher key len return by OpenSSL. Fix break AES-128-CBC on Ruby 2.5.3. Change hard code 32 key len by cipher key len returned by OpenSSL. Oct 3, 2020
@dennissivia
Copy link

@chicks any thoughts on this PR?
I am running into the same problem with the hard coded value. The fix seems like a general improvement and it would be great if we could merge it.

@ntloi95
Copy link
Author

ntloi95 commented Mar 10, 2021

This project is deserted. :'( @dennissivia

@dennissivia
Copy link

@ntloi95 yeah, it seems so. And if nobody is at least merging fixes, I guess I have to switch to OpenSSL or another gem.

@vanaltj based on the last commit it seems that you also have permission to merge PRs?
Can you take a look at this PR? That would be amazing.

@dennissivia
Copy link

@ntloi95 I guess you are right. Seems as if it will take some time until the PR will be merged if it will ever happen.
In my project I decided to create this monkey patch based on your solution. So I am not blocked and can take my time to replace the implementation with OpenSSL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants