v1.0.1g command line gcm error

Tom stone

unread,

May 13, 2014, 12:06:29 PM5/13/14

to

Using openssl-1.0.1g command line for simple file encryption/decryption, when I issue the commands

openssl enc -aes-256-cbc -k secret -in file.txt -out file.ssl
openssl enc -d -aes-256-cbc -k secret -in file.ssl

The contents of file.txt go to stdout as expected. However, when I issue the commands

openssl enc -aes-256-gcm -k secret -in file.txt -out file.ssl
openssl enc -d -aes-256-gcm -k secret -in file.ssl

The contents of file.txt go to stdout but the string "bad decrypt" goes to stderr.

Am I missing something or is there a bug in the openssl gcm implementation?

I have tried substituting "-pass pass:secret" for "-k secret" and get the same results.

If I had to venture a guess, I would expect that the decrypt option verifies that the input represents a full block of data and throws the error when the gcm encrypted file does not end on a block boundary.

Jeremy Gray

unread,

May 13, 2014, 12:26:32 PM5/13/14

to

I had exactly this issue a few days ago. Turns out that there's a bug in setting up the GCM cipher, so the enc part is not working correctly for GCM. More than that, someone else will have to elaborate if you are interested.

--Jeremy

Tom stone

unread,

May 13, 2014, 12:42:52 PM5/13/14

to

Jeremy,

Thank you for your quick response. I am definitely interested in additional details. If you know who I should contact that would be great. Do you know whether this only effects simple file encryption or is it general to the gcm mode, ie. would it effect tcp/ip traffic?

Thanks

Jeremy Gray

unread,

May 13, 2014, 1:03:22 PM5/13/14

to

Hopefully someone else on the list can speak to your further questions….

--Jeremy

Dr. Stephen Henson

unread,

May 13, 2014, 1:19:19 PM5/13/14

to

On Tue, May 13, 2014, Tom stone wrote:

> Jeremy,
>
> Thank you for your quick response. I am definitely interested in
> additional details. If you know who I should contact that would be great.
> Do you know whether this only effects simple file encryption or is it
> general to the gcm mode, ie. would it effect tcp/ip traffic?
>

There is no problem with GCM it's a problem with the "enc" utility. It doesn't
support GCM mode properly (it doesn't store/retrieve the tag) and it should
either be extended to support GCM mode or GCM mode not allowed in enc at all.

Steve.
--
Dr Stephen N. Henson. OpenSSL project core developer.
Commercial tech support now available see: http://www.openssl.org
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openss...@openssl.org
Automated List Manager majo...@openssl.org

Jeffrey Walton

unread,

May 15, 2014, 5:39:47 AM5/15/14

to

On Tue, May 13, 2014 at 12:06 PM, Tom stone <ston...@gmail.com> wrote:
> Using openssl-1.0.1g command line for simple file encryption/decryption,
> when I issue the commands
>
> openssl enc -aes-256-cbc -k secret -in file.txt -out file.ssl
> openssl enc -d -aes-256-cbc -k secret -in file.ssl
>
> The contents of file.txt go to stdout as expected. However, when I issue the
> commands
>
> openssl enc -aes-256-gcm -k secret -in file.txt -out file.ssl
> openssl enc -d -aes-256-gcm -k secret -in file.ssl
>
> The contents of file.txt go to stdout but the string "bad decrypt" goes to
> stderr.
>
> Am I missing something or is there a bug in the openssl gcm implementation?

If its any consolation, your question triggered a documentation patch.
Matt Caswell recently committed it. "Add information to BUGS section
of enc documentation. PR#3354",
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=18c4f522f49eb54a61bada6d39a8b137b6751f01hb=18c4f522f49eb54a61bada6d39a8b137b6751f01;hpb=ab6577a46ecee670b640f0ee49e2ebef80ad18a7.
And http://wiki.openssl.org/index.php/Manual:Enc(1).

Matt Caswell

unread,

May 15, 2014, 2:37:36 PM5/15/14

to

On 15 May 2014 10:39, Jeffrey Walton <nolo...@gmail.com> wrote:
> On Tue, May 13, 2014 at 12:06 PM, Tom stone <ston...@gmail.com> wrote:
>>
>> Am I missing something or is there a bug in the openssl gcm implementation?
>
> If its any consolation, your question triggered a documentation patch.
> Matt Caswell recently committed it. "Add information to BUGS section
> of enc documentation. PR#3354",
> https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=18c4f522f49eb54a61bada6d39a8b137b6751f01hb=18c4f522f49eb54a61bada6d39a8b137b6751f01;hpb=ab6577a46ecee670b640f0ee49e2ebef80ad18a7.
> And http://wiki.openssl.org/index.php/Manual:Enc(1).

And I'm about to revert it, because Steve Henson just committed a fix
for the bug (i.e. to fail gracefully if you attempt to use an AEAD
cipher)!!

Matt

Jeffrey Walton

unread,

May 15, 2014, 2:54:02 PM5/15/14

to

On Thu, May 15, 2014 at 2:37 PM, Matt Caswell <ma...@openssl.org> wrote:
> On 15 May 2014 10:39, Jeffrey Walton <nolo...@gmail.com> wrote:
>> On Tue, May 13, 2014 at 12:06 PM, Tom stone <ston...@gmail.com> wrote:
>>>
>>> Am I missing something or is there a bug in the openssl gcm implementation?
>>
>> If its any consolation, your question triggered a documentation patch.
>> Matt Caswell recently committed it. "Add information to BUGS section
>> of enc documentation. PR#3354",
>> https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=18c4f522f49eb54a61bada6d39a8b137b6751f01hb=18c4f522f49eb54a61bada6d39a8b137b6751f01;hpb=ab6577a46ecee670b640f0ee49e2ebef80ad18a7.
>> And http://wiki.openssl.org/index.php/Manual:Enc(1).
>
> And I'm about to revert it, because Steve Henson just committed a fix
> for the bug (i.e. to fail gracefully if you attempt to use an AEAD
> cipher)!!

Nice ;)

Perhaps there should be a note for folks using down level version of
the library.