5 ms·

Luckily, in PHP land, I can do it wrong without ever having to type the letters A-E-S anywhere, because the relevant mcrypt constants are named MCRYPT_RIJNDAEL_

Luckily, in PHP land, I can do it wrong without ever having to type the letters A-E-S anywhere, because the relevant mcrypt constants are named MCRYPT_RIJNDAEL_128, MCRYPT_RIJNDAEL_192, and MCRYPT_RIJNDAEL_256. Nevermind the fact that only MCRYPT_RIJNDAEL_128 is actually AES, most developers choose MCRYPT_RIJNDAEL_256 and claim they're implementing AES-256. To wit (trigger warning, encraption and severe arrogance on its developer's behalf follows): https://github.com/opencart/opencart/blob/99bcfb24519ef3a4117e9300ea759e58e4c0826d/upload/system/library/encryption.php https://github.com/opencart/opencart/blob/99bcfb24519ef3a411... https://github.com/opencart/opencart/issues/1279 https://github.com/opencart/opencart/issues/1279 https://github.com/opencart/opencart/issues/1594 https://github.com/opencart/opencart/issues/1594 And this is an eCommerce platform. If anyone is feeling frustrated by the constant "don't roll your own crypto" advice from the experts, it's being said for a damn good reason. Also, don't use opencart's encryption library.

F30 12y ago
It is out of question that you can do it wrong without typing A-E-S: Crypto is hard, and you can always fuck up in an infinite amount of ways. That being said, do you have any reference on MCRYPT_RIJNDAEL_256 being an actual problem? The linked OpenCart issues deal with ECB mode and missing authentication, rather than the block size.
- sarciszewski 12y ago
  It's not really a problem so much as it's not doing what they think it's doing. 256-bit block-size Rijndael might even be better than 128-bit (AES). I don't know.
ayrx 12y ago
I'm the one that reported issue #1279. The owner of the project has shown that he has absolutely no interest in addressing (or even politely replying to) security issues in his code so I'd advise anyone to steer clear of opencart.

F30 12y ago

It is out of question that you can do it wrong without typing A-E-S: Crypto is hard, and you can always fuck up in an infinite amount of ways. That being said, do you have any reference on MCRYPT_RIJNDAEL_256 being an actual problem? The linked OpenCart issues deal with ECB mode and missing authentication, rather than the block size.

sarciszewski 12y ago
It's not really a problem so much as it's not doing what they think it's doing. 256-bit block-size Rijndael might even be better than 128-bit (AES). I don't know.

ayrx 12y ago

I'm the one that reported issue #1279. The owner of the project has shown that he has absolutely no interest in addressing (or even politely replying to) security issues in his code so I'd advise anyone to steer clear of opencart.