Skip to content

[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages - #32300

Closed
idrassi wants to merge 2 commits into
openssl:openssl-4.0from
amcrypto-jp:backport-32173-4.0
Closed

[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages#32300
idrassi wants to merge 2 commits into
openssl:openssl-4.0from
amcrypto-jp:backport-32173-4.0

Conversation

@idrassi

@idrassi idrassi commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Fixes #32258

This backports #32173 (commit 5741d29) to openssl-4.0, with a branch-specific adaptation and dedicated regression coverage.

For the affected built-in provider implementations, EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a NULL-input terminal call. ChaCha20-Poly1305 and AES-OCB can otherwise return success for an empty ciphertext without checking an explicitly supplied tag, while AES-GCM-SIV doesn't generate its tag when Final is the first empty-message operation.

The implementation changes are the provider portions of the master fix:

  • route NULL AES-OCB input through aes_ocb_block_final
  • allow the ChaCha20-Poly1305 ccipher callback to perform the terminal tag operation while retaining zero-length Update as a no-op in 4.0's existing dedicated Update callback
  • generate the AES-GCM-SIV tag for an empty message and propagate failures from the matching decrypt operation

The generic master test modified by 5741d29 is not present on 4.0. So, a dedicated stable-branch regression test is included instead. It covers correct-tag acceptance, corrupted-tag rejection, and encryption tag generation for AES-OCB, ChaCha20-Poly1305, and AES-GCM-SIV, both with and without AAD.

Validation on openssl-4.0:

./config --strict-warnings no-shared enable-fips
make -j6
make test TESTS='test_evp test_evp_extra' HARNESS_JOBS=4

The strict-warnings build completed successfully under WSL2 with GCC 13.3, and the focused suites passed all 182 tests.

Checklist
  • tests are added or updated

@openssl-ci-bot openssl-ci-bot Bot added the approval: review pending This pull request needs review by a committer label Aug 11, 2026
@github-actions github-actions Bot added the severity: fips change The pull request changes FIPS provider sources label Aug 11, 2026
This was referenced Aug 11, 2026
Closed
Closed
@t8m

t8m commented Aug 18, 2026

Copy link
Copy Markdown
Member

@idrassi Could you please amend the commit message of the first commit to add:
Fixes CVE-2026-75803

@t8m t8m added triaged: bug The issue/pr is/fixes a bug tests: present The PR has suitable tests present branch: 4.0 Applies to openssl-4.0 labels Aug 18, 2026
@openssl-ci-bot openssl-ci-bot Bot added approval: done This pull request has the required number of approvals and removed approval: review pending This pull request needs review by a committer labels Aug 18, 2026
This was referenced Aug 18, 2026
Closed
Closed
@esyr esyr linked an issue Aug 18, 2026 that may be closed by this pull request
Invalid tags can be accepted for empty ChaCha20-Poly1305 and OCB ciphertexts via EVP_Cipher() #32258
Closed
bbbrumley and others added 2 commits August 19, 2026 10:43
@bbbrumley @idrassi
Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs
953d436 
For the affected OpenSSL built-in provider AEAD implementations,
EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a
NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit
on an empty message, with or without AAD, and returned success without
comparing an explicitly supplied tag. Consequently a corrupted tag was
accepted before this change.

Make these built-in callbacks perform their terminal tag operation,
aligning their explicit-tag handling with the streaming Final path
without defining NULL input as part of the generic EVP_Cipher()
contract.

AES-GCM-SIV also failed to generate a tag when Final was its first
empty-message operation. Generate the tag in that case and propagate
failures from the matching empty-message decrypt operation.

OpenSSL 4.0 already has a dedicated ChaCha20-Poly1305 Update callback,
so keep zero-length Update as a no-op there while allowing the
NULL-input ccipher call to perform the terminal tag operation.

Follow-up to openssl#31555
Fixes openssl#32258
Fixes CVE-2026-75803

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol

(cherry picked from commit 5741d29)

Co-authored-by: Mounir IDRASSI <[email protected]>
@idrassi
Add tests for empty AEAD EVP_Cipher() finalization
ee66ea0 
Generate an empty-message tag with the streaming path, then check that
EVP_Cipher() decryption accepts the correct tag and rejects a corrupted
one. Also verify that EVP_Cipher() encryption produces the same tag.

Cover AES-OCB, ChaCha20-Poly1305, and AES-GCM-SIV, with and without AAD.

Assisted-by: Codex:gpt-5.6-sol
@idrassi
idrassi force-pushed the backport-32173-4.0 branch from 8fcd6aa to ee66ea0 Compare August 19, 2026 01:47
@idrassi

idrassi commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@t8m commit message amended.

@openssl-ci-bot

openssl-ci-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown

24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually.

@t8m t8m added approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: done This pull request has the required number of approvals labels Aug 19, 2026
@t8m

t8m commented Aug 19, 2026

Copy link
Copy Markdown
Member

Merged to the 4.0 branch. Thank you for your contribution.

@t8m t8m closed this Aug 19, 2026
openssl-machine pushed a commit that referenced this pull request Aug 19, 2026
@bbbrumley @idrassi @t8m
Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADs
6c7aa6f 
For the affected OpenSSL built-in provider AEAD implementations,
EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a
NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit
on an empty message, with or without AAD, and returned success without
comparing an explicitly supplied tag. Consequently a corrupted tag was
accepted before this change.

Make these built-in callbacks perform their terminal tag operation,
aligning their explicit-tag handling with the streaming Final path
without defining NULL input as part of the generic EVP_Cipher()
contract.

AES-GCM-SIV also failed to generate a tag when Final was its first
empty-message operation. Generate the tag in that case and propagate
failures from the matching empty-message decrypt operation.

OpenSSL 4.0 already has a dedicated ChaCha20-Poly1305 Update callback,
so keep zero-length Update as a no-op there while allowing the
NULL-input ccipher call to perform the terminal tag operation.

Follow-up to #31555
Fixes #32258
Fixes CVE-2026-75803

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Codex:gpt-5.6-sol

(cherry picked from commit 5741d29)

Co-authored-by: Mounir IDRASSI <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 15:56:02 2026
Merged-from: #32300
openssl-machine pushed a commit that referenced this pull request Aug 19, 2026
@idrassi @t8m
Add tests for empty AEAD EVP_Cipher() finalization
14d058f 
Generate an empty-message tag with the streaming path, then check that
EVP_Cipher() decryption accepts the correct tag and rejects a corrupted
one. Also verify that EVP_Cipher() encryption produces the same tag.

Cover AES-OCB, ChaCha20-Poly1305, and AES-GCM-SIV, with and without AAD.

Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Wed Aug 19 15:56:03 2026
Merged-from: #32300
openssl-machine pushed a commit that referenced this pull request Aug 25, 2026
@esyr @jogme
CHANGES.md, NEWS.md: update for 4.0.2
05e9936 
4.0.2 CHANGES.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * #31174
   "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
   (already present)
 * #31572
   "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts"
 * #31749
   "Add documentation for OPENSSL_armcap"
 * #31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * #32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * #32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * #32427
   "Backport #32256 openssl 4.0 to 3.0"

4.0.2 NEWS.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * #31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * #32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * #32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * #32427
   "Backport #32256 openssl 4.0 to 3.0"

Signed-off-by: Eugene Syromiatnikov <[email protected]>

14456

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Tue Aug 25 11:33:50 2026
esyr added a commit to esyr/openssl that referenced this pull request Aug 25, 2026
@esyr
CHANGES.md, NEWS.md: update for 4.0.2
31b337b 
4.0.2 CHANGES.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * openssl#31174
   "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
   (already present)
 * openssl#31572
   "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts"
 * openssl#31749
   "Add documentation for OPENSSL_armcap"
 * openssl#31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * openssl#32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * openssl#32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * openssl#32427
   "Backport openssl#32256 openssl 4.0 to 3.0"

4.0.2 NEWS.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * openssl#31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * openssl#32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * openssl#32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * openssl#32427
   "Backport openssl#32256 openssl 4.0 to 3.0"

Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Aug 25, 2026
@esyr
CHANGES.md, NEWS.md: update for 4.0.2
ae62dc6 
4.0.2 CHANGES.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * openssl#31174
   "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
   (already present)
 * openssl#31572
   "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts"
 * openssl#31749
   "Add documentation for OPENSSL_armcap"
 * openssl#31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * openssl#32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * openssl#32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * openssl#32427
   "Backport openssl#32256 openssl 4.0 to 3.0"

4.0.2 NEWS.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * openssl#31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * openssl#32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * openssl#32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * openssl#32427
   "Backport openssl#32256 openssl 4.0 to 3.0"

Signed-off-by: Eugene Syromiatnikov <[email protected]>
openssl-machine pushed a commit that referenced this pull request Aug 28, 2026
@esyr @jogme
CHANGES.md, NEWS.md: update for 4.0.2
b350fb2 
4.0.2 CHANGES.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * #31174
   "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
   (already present)
 * #31572
   "[4.0, 3.6, 3.5, 3.4] Add icx compiler version support in perl asm scripts"
 * #31749
   "Add documentation for OPENSSL_armcap"
 * #31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * #32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * #32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * #32427
   "Backport #32256 openssl 4.0 to 3.0"

4.0.2 NEWS.md includes the following:
 * CVE-2026-14456, CVE-2026-14457, CVE-2026-18798, CVE-2026-54874,
   CVE-2026-54876, CVE-2026-63072, CVE-2026-63073, CVE-2026-63074,
   CVE-2026-63075, CVE-2026-63076, CVE-2026-75803
 * #31764
   "x509: fix OCSP BasicResponse leak during verification"
   (included as CVE-2026-54876)
 * #32052
   "QUIC server: limit the number of pending connections"
   (included as CVE-2026-14456)
 * #32300
   "[4.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * #32427
   "Backport #32256 openssl 4.0 to 3.0"

Signed-off-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Merge-date: Fri Aug 28 11:16:09 2026
Merged-from: #32484
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mbroz mbroz mbroz approved these changes
@t8m t8m t8m approved these changes

Assignees

No one assigned

Labels

approval: ready to merge The 24 hour grace period has passed, ready to merge branch: 4.0 Applies to openssl-4.0 severity: fips change The pull request changes FIPS provider sources tests: present The PR has suitable tests present triaged: bug The issue/pr is/fixes a bug

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Invalid tags can be accepted for empty ChaCha20-Poly1305 and OCB ciphertexts via EVP_Cipher()

4 participants

@idrassi @t8m @mbroz @bbbrumley