Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.5] iv initialize in encrypt(): remove magic literal #18684

Merged
merged 1 commit into from
Apr 6, 2017
Merged

[5.5] iv initialize in encrypt(): remove magic literal #18684

merged 1 commit into from
Apr 6, 2017

Conversation

Snawoot
Copy link
Contributor

@Snawoot Snawoot commented Apr 5, 2017

No description provided.

@Snawoot Snawoot changed the base branch from 5.4 to master April 5, 2017 19:16
@tillkruss
Copy link
Contributor

Can you explain this change this in detail, please?

@fernandobandeira
Copy link
Contributor

fernandobandeira commented Apr 6, 2017

Basically this function will get the required iv length for each cipher, currently we support AES-128-CBC and AES-256-CBC.

It does make sense to use this function instead of hardcoding 16 there...

@Snawoot
Copy link
Contributor Author

Snawoot commented Apr 6, 2017

Hello,

Sorry for too short comment. IV length varies for different ciphers. Currently Encrypter uses only AES and 16 bytes long IV is valid for both 128 and 256 variants it supports, but cipher whitelist may change in future. Actually, it should change because even if AES is the best symmetric cipher ever, in some countries local regulations allows to use only locally certified ciphers for commercial applications.

This commit removes unneeded IV length hardcode. Probably in future Encrypted class should have extended cipher whitelist OR capability to accept custom whitelist.

@taylorotwell taylorotwell merged commit 972ce80 into laravel:master Apr 6, 2017
@tillkruss
Copy link
Contributor

@Snawoot: Is there any breaking change with this, or will everything that was encrypted in v5.4 be decryptable in v5.5?

@Snawoot
Copy link
Contributor Author

Snawoot commented Apr 6, 2017

@tillkruss no changes in data representation will occur, everything will be decryptable

@GrahamCampbell GrahamCampbell changed the title iv initialize in encrypt(): remove magic literal [5.5] iv initialize in encrypt(): remove magic literal Apr 7, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants