Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-9069

extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm

Details

    • 10.3.3-1

    Description

      extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

      AES_ENCRYPT(text, key, [IV [, algorithm]])

      and @@block_encryption_mode variable as in 5.7

      NOTE:

      • change in behavior: AES_ENCRYPT(str, key) can no longer be used in persistent virtual columns (and alike)
      • New system variable block_encryption_mode

      Attachments

        Issue Links

          blocks

          Task - A task that needs to be done. MDEV-11476 AES_ENCRYPT/DECRYPT: Improper key sizes aren't handled correctly

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open
          causes

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31633 Assertion `!item->null_value' failed in Type_handler::Item_send_str

          • Major - Major loss of function.
          • Closed
          is blocked by

          Task - A task that needs to be done. MDEV-10332 Server 10.2: Add support for OpenSSL 1.1

          • Major - Major loss of function.
          • Closed
          is duplicated by

          Task - A task that needs to be done. MDEV-28721 Initialization vector for AES_{EN,DE}CRYPT

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          is part of

          Task - A task that needs to be done. MDEV-28906 MySQL 8.0 desired compatibility

          • Major - Major loss of function.
          • Open
          relates to

          Task - A task that needs to be done. MDEV-31474 KDF() function

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-33659 Server crashed at Create_func_aes_decrypt::create_native

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          links to

          Web Link CVE-2022-21592

          Activity

            Ascending order - Click to sort in descending order
            serg Sergei Golubchik created issue -
            serg Sergei Golubchik made changes -
            Field Original Value New Value
            Fix Version/s 10.2 [ 14601 ]
            serg Sergei Golubchik made changes -
            Description extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like
            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}
            and {{@@ block_encryption_mode}} variable as in 5.7             		extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like
            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}
            and {{@@block_encryption_mode}} variable as in 5.7
            georg Georg Richter made changes -
            Assignee Georg Richter [ georg ]
            georg Georg Richter made changes -
            Assignee Georg Richter [ georg ] Sergei Golubchik [ serg ]
            Status Open [ 1 ] In Review [ 10002 ]
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Georg Richter [ georg ]
            Status In Review [ 10002 ] Stalled [ 10000 ]
            georg Georg Richter made changes -
            Fix Version/s 10.2.4 [ 22116 ]
            Fix Version/s 10.2 [ 14601 ]
            georg Georg Richter made changes -
            georg Georg Richter made changes -
            Description extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like
            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}
            and {{@@block_encryption_mode}} variable as in 5.7             		extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like
            {noformat}
            AES_ENCRYPT(text, key, [IV [, AAD [ USING algorithm]]])
            {noformat}
            and {{@@block_encryption_mode}} variable as in 5.7
            georg Georg Richter made changes -
            Fix Version/s 10.2 [ 14601 ]
            Fix Version/s 10.2.4 [ 22116 ]
            georg Georg Richter added a comment -

            Current GCM implementation seems to be buggy - rfc test vectors for GCM partially fail - it will need some more investigation.

            georg Georg Richter added a comment - Current GCM implementation seems to be buggy - rfc test vectors for GCM partially fail - it will need some more investigation.
            serg Sergei Golubchik made changes -
            Fix Version/s 10.3 [ 22126 ]
            Fix Version/s 10.2 [ 14601 ]
            serg Sergei Golubchik made changes -
            Sprint 10.3.3-1 [ 200 ]
            serg Sergei Golubchik made changes -
            Fix Version/s 10.4 [ 22408 ]
            Fix Version/s 10.3 [ 22126 ]
            serg Sergei Golubchik made changes -
            Assignee Georg Richter [ georg ] Sergei Golubchik [ serg ]
            serg Sergei Golubchik made changes -
            ralf.gebhardt Ralf Gebhardt made changes -
            Epic Link PT-73 [ 68549 ]
            serg Sergei Golubchik made changes -
            Labels upstream-fixed beginner-friendly upstream-fixed
            serg Sergei Golubchik made changes -
            Fix Version/s 10.5 [ 23123 ]
            Fix Version/s 10.4 [ 22408 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            Epic Link PT-73 [ 68549 ]
            serg Sergei Golubchik made changes -
            Fix Version/s 10.5 [ 23123 ]
            juanparati Juan Lago added a comment -

            Is it this feature going to be implemented some day?

            IV is mostly a common practice in the industry for encryption with AES-256-CBC cipher.

            It makes also hard to migrate from MySQL to MariaDB due the lack of this function.

            juanparati Juan Lago added a comment - Is it this feature going to be implemented some day? IV is mostly a common practice in the industry for encryption with AES-256-CBC cipher. It makes also hard to migrate from MySQL to MariaDB due the lack of this function.
            serg Sergei Golubchik added a comment -

            yes

            serg Sergei Golubchik added a comment - yes
            philipp.grafe@pitcom.de Philipp Grafe added a comment -

            Is there already a new time schedule or version? We are also eagerly waiting for this.

            philipp.grafe@pitcom.de Philipp Grafe added a comment - Is there already a new time schedule or version? We are also eagerly waiting for this.
            serg Sergei Golubchik made changes -
            Workflow MariaDB v3 [ 72420 ] MariaDB v4 [ 131654 ]
            greenman Ian Gilfillan made changes -
            Labels beginner-friendly upstream-fixed beginner-friendly compat80 upstream-fixed
            monty Michael Widenius made changes -
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik made changes -
            Fix Version/s 10.11 [ 27614 ]
            serg Sergei Golubchik made changes -
            Priority Major [ 3 ] Critical [ 2 ]
            AirFocus AirFocus made changes -
            Description extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like
            {noformat}
            AES_ENCRYPT(text, key, [IV [, AAD [ USING algorithm]]])
            {noformat}
            and {{@@block_encryption_mode}} variable as in 5.7             		extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, AAD [ USING algorithm]]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7
            ralf.gebhardt Ralf Gebhardt made changes -
            Fix Version/s 10.12 [ 28320 ]
            Fix Version/s 10.11 [ 27614 ]
            serg Sergei Golubchik made changes -
            Comment [ A comment with security level 'Developers' was removed. ]
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik added a comment - - edited

            MySQL implements

            AES_ENCRYPT(str, key_str [,init_vector [,kdf_name [,salt [,info | iterations]]]])

            with 6 positional arguments this is, I think, way out of comfort usage zone. And it does not allow to specify the mode, it has to be specified via block_encryption_mode variable. I would rather suggest

            AES_ENCRYPT(str, key [,iv] [USING mode])

            2- and 3-argument syntax is compatible with MySQL. Encryption mode is specified via a keyword, so it won't cause ambiguities if we'll later want to add full MySQL compatibility syntax.
            But I think it'd be more user-friendly to add a separate function, say,

            KDF(key_str [, kdf_name [, salt [, info | iterations]]])

            which is not part of this task

            serg Sergei Golubchik added a comment - - edited MySQL implements AES_ENCRYPT(str, key_str [,init_vector [,kdf_name [,salt [,info | iterations]]]]) with 6 positional arguments this is, I think, way out of comfort usage zone. And it does not allow to specify the mode, it has to be specified via block_encryption_mode variable . I would rather suggest AES_ENCRYPT(str, key [,iv] [USING mode]) 2- and 3-argument syntax is compatible with MySQL. Encryption mode is specified via a keyword, so it won't cause ambiguities if we'll later want to add full MySQL compatibility syntax. But I think it'd be more user-friendly to add a separate function, say, KDF(key_str [, kdf_name [, salt [, info | iterations]]]) which is not part of this task
            serg Sergei Golubchik made changes -
            Fix Version/s 11.1 [ 28549 ]
            Fix Version/s 11.0 [ 28320 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            Fix Version/s 11.2 [ 28603 ]
            Fix Version/s 11.1 [ 28549 ]
            serg Sergei Golubchik added a comment - - edited

            On the other hand, the syntax without a keyword will make it a normal function with no special rules in the parser. And the server will still be able avoid ambiguities because kdf values differ from mode values.

            serg Sergei Golubchik added a comment - - edited On the other hand, the syntax without a keyword will make it a normal function with no special rules in the parser. And the server will still be able avoid ambiguities because kdf values differ from mode values.
            serg Sergei Golubchik made changes -
            Status Stalled [ 10000 ] In Progress [ 3 ]
            serg Sergei Golubchik made changes -
            Status In Progress [ 3 ] In Testing [ 10301 ]
            serg Sergei Golubchik made changes -
            serg Sergei Golubchik made changes -
            Status In Testing [ 10301 ] Stalled [ 10000 ]
            serg Sergei Golubchik made changes -
            Assignee Sergei Golubchik [ serg ] Oleksandr Byelkin [ sanja ]
            Status Stalled [ 10000 ] In Review [ 10002 ]
            serg Sergei Golubchik made changes -
            Status In Review [ 10002 ] In Testing [ 10301 ]
            serg Sergei Golubchik made changes -
            Assignee Oleksandr Byelkin [ sanja ] Ramesh Sivaraman [ JIRAUSER48189 ]
            serg Sergei Golubchik made changes -
            Description extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, AAD [ USING algorithm]]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7             		extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7
            lstartseva Lena Startseva made changes -
            Assignee Ramesh Sivaraman [ JIRAUSER48189 ] Lena Startseva [ JIRAUSER50478 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            Labels beginner-friendly compat80 upstream-fixed Preview_11.2 beginner-friendly compat80 upstream-fixed
            serg Sergei Golubchik made changes -
            lstartseva Lena Startseva added a comment -

            Ok to push

            lstartseva Lena Startseva added a comment - Ok to push
            lstartseva Lena Startseva made changes -
            Assignee Lena Startseva [ JIRAUSER50478 ] Sergei Golubchik [ serg ]
            Status In Testing [ 10301 ] Stalled [ 10000 ]
            serg Sergei Golubchik made changes -
            Component/s Encryption [ 11200 ]
            Fix Version/s 11.2.1 [ 29034 ]
            Fix Version/s 11.2 [ 28603 ]
            Resolution Fixed [ 1 ]
            Status Stalled [ 10000 ] Closed [ 6 ]
            ralf.gebhardt Ralf Gebhardt made changes -
            Description extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7             		extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7


            NOTE:
            * change in behavior: AES_ENCRYPT(str, key) can no longer be used in persistent virtual columns (and alike)
            ralf.gebhardt Ralf Gebhardt made changes -
            Description extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7


            NOTE:
            * change in behavior: AES_ENCRYPT(str, key) can no longer be used in persistent virtual columns (and alike)             		extend AES_ENCRYPT() and AES_DECRYPT() to support IV and the algorithm. Something like

            {noformat}
            AES_ENCRYPT(text, key, [IV [, algorithm]])
            {noformat}

            and {{@@block_encryption_mode}} variable as in 5.7


            NOTE:
            * change in behavior: AES_ENCRYPT(str, key) can no longer be used in persistent virtual columns (and alike)
            * New system variable _block_encryption_mode_
            alice Alice Sherepa made changes -
            mariadb-jira-automation Jira Automation (IT) made changes -
            Zendesk Related Tickets 140721 170960

            People

              serg Sergei Golubchik
              serg Sergei Golubchik
              Votes:
              15 Vote for this issue
              Watchers:
              20 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.