Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User lower case cipher names for maximum compatibility #384

Merged
merged 1 commit into from Jul 8, 2020

Conversation

bdewater
Copy link
Contributor

@bdewater bdewater commented Jul 7, 2020

We ran into some Linux-based systems not accepting the upper case variant, see rubocop/rubocop#8262

We ran into some Linux-based systems not accepting the upper case variant
@tas50
Copy link

tas50 commented Jul 7, 2020

@bdewater Any idea which versions of openssl are impacted by the uppercase ciphers?

@bdewater
Copy link
Contributor Author

bdewater commented Jul 7, 2020

Seems Ubuntu 16.04 supports some uppercase ciphers (e.g. AES-128-CBC) and 20.04 none. We didn't find anything in the changelog between OpenSSL 1.0.2 and 1.1.1 about this but also we just fixed it and moved on.

@rhenium
Copy link
Member

rhenium commented Jul 8, 2020

For more context, the AES-GCM ciphers have an associated "short name" id-aesNNN-GCM and a "long name" aes-NNN-gcm while many other AES ciphers have a short name AES-NNN-<mode> (in upper case) and a long name aes-NNN-<mode> (in lower case).

EVP_get_cipherbyname(), which OpenSSL::Cipher.new calls, takes both short names and long names. It was doing case-sensitive string comparison in OpenSSL versions prior to 1.1.0j or 1.1.1, hence OpenSSL::Cipher.new("AES-128-GCM") did not work.

@rhenium rhenium merged commit 3d16091 into ruby:master Jul 8, 2020
@bdewater bdewater deleted the lower-case-cipher branch July 8, 2020 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants