Adding Support for authenticated encryption modes

[Neurrone]

I'm able to encrypt it with e.g aes-128-gcm but am unable to decrypt the result, probably because there's currently no way to get the tag.

[daurnimator]

Please elaborate: what did you try? what did you expect to work?

[daurnimator]

@Neurrone ping?

[Sorc96]

I need to decrypt using aes-256-gcm. It is currently possible to decrypt the message, but I cannot verify its authenticity, because there is no way to set the expected value of the tag. Calling final should return an empty string if the tag matches the expected value. Currently, final always returns nil and an error, because the cipher is missing the expected tag value.

Looking at an example from OpenSSL, the missing piece seems to be the EVP_CIPHER_CTX_ctrl function. It is used both for getting the tag when encrypting and setting the expected value when decrypting.
OpenSSL example

[daurnimator]

Currently, final always returns nil and an error, because the cipher is missing the expected tag value.

Could you give us an example of the code you're trying?

[Sorc96]

-- I don't need to encrypt in my real situation,
-- this just to get an encrypted message for this example
local cipher = require "openssl.cipher"
local key = "abcdefghijklmnopabcdefghijklmnop"
local iv = "123456123456"
local message = "My secret message"
local encrypted = cipher.new("aes-256-gcm"):encrypt(key, iv):update(message)
-- There should be a way to get the tag now

-- Now for the decryption
local aes = cipher.new("aes-256-gcm"):decrypt(key, iv)
local decrypted = aes:update(encrypted)
print(decrypted)
-- The message is decrypted succesfully, but now there should be a way to set the expected tag
-- Calling final returns an error, as it should when the expected tag value is not set or the tag does not match the expected value
print(aes:final())

[mwild1]

This is quite a large gap in the API, and makes using the widespread CCM/GCM modes unsafe in many contexts (as the ciphertext may have been corrupted or tampered with) and useless for interoperability with any software that attempts to authenticate the received data. Most cipher APIs in other languages/frameworks either append the tag (MAC) to the end of the ciphertext output or let you obtain the tag after completion.

In OpenSSL, obtaining the tag is done by calling EVP_CIPHER_CTX_ctrl() after the ciphertext is complete. Full examples can be found on the OpenSSL wiki in 'EVP Authenticated Encryption and Decryption'.

I don't mind submitting a PR for this, but it likely won't be before next week.