From 3e21135eca4c5413ad15ad888212164de3c40337 Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Mon, 19 Jul 2021 01:58:16 +0200 Subject: [PATCH 1/2] Disable OpenSSL EVP digest padding in pgcrypto The PX layer in pgcrypto is handling digest padding on its own uniformly for all backend implementations. Starting with OpenSSL 3.0.0, DecryptUpdate doesn't flush the last block in case padding is enabled so explicitly disable it as we don't use it. Discussion: https://postgr.es/m/FEF81714-D479-4512-839B-C769D2605F8A@yesql.se --- contrib/pgcrypto/openssl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contrib/pgcrypto/openssl.c b/contrib/pgcrypto/openssl.c index ed8e74a2b9..e236b0d79c 100644 --- a/contrib/pgcrypto/openssl.c +++ b/contrib/pgcrypto/openssl.c @@ -379,6 +379,8 @@ gen_ossl_decrypt(PX_Cipher *c, const uint8 *data, unsigned dlen, { if (!EVP_DecryptInit_ex(od->evp_ctx, od->evp_ciph, NULL, NULL, NULL)) return PXE_CIPHER_INIT; + if (!EVP_CIPHER_CTX_set_padding(od->evp_ctx, 0)) + return PXE_CIPHER_INIT; if (!EVP_CIPHER_CTX_set_key_length(od->evp_ctx, od->klen)) return PXE_CIPHER_INIT; if (!EVP_DecryptInit_ex(od->evp_ctx, NULL, NULL, od->key, od->iv)) @@ -403,6 +405,8 @@ gen_ossl_encrypt(PX_Cipher *c, const uint8 *data, unsigned dlen, { if (!EVP_EncryptInit_ex(od->evp_ctx, od->evp_ciph, NULL, NULL, NULL)) return PXE_CIPHER_INIT; + if (!EVP_CIPHER_CTX_set_padding(od->evp_ctx, 0)) + return PXE_CIPHER_INIT; if (!EVP_CIPHER_CTX_set_key_length(od->evp_ctx, od->klen)) return PXE_CIPHER_INIT; if (!EVP_EncryptInit_ex(od->evp_ctx, NULL, NULL, od->key, od->iv)) -- 2.30.1 (Apple Git-130)