OpenSSL 3.0.1+ deprecated some algorithms

terrafrost · terrafrost · commit c99e38b7c9ae · 2022-12-16T22:16:49.000-06:00
diff --git a/phpseclib/Crypt/Blowfish.php b/phpseclib/Crypt/Blowfish.php
@@ -515,6 +515,12 @@ function setKeyLength($length)
     function isValidEngine($engine)
     {
         if ($engine == CRYPT_ENGINE_OPENSSL) {
+            // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1
+            // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"
+            // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not
+            if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {
+                return false;
+            }
             if (version_compare(PHP_VERSION, '5.3.7') < 0 && $this->key_length != 16) {
                 return false;
             }
diff --git a/phpseclib/Crypt/DES.php b/phpseclib/Crypt/DES.php
@@ -665,6 +665,12 @@ function isValidEngine($engine)
     {
         if ($this->key_length_max == 8) {
             if ($engine == CRYPT_ENGINE_OPENSSL) {
+                // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1
+                // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"
+                // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not
+                if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {
+                    return false;
+                }
                 $this->cipher_name_openssl_ecb = 'des-ecb';
                 $this->cipher_name_openssl = 'des-' . $this->_openssl_translate_mode();
             }
diff --git a/phpseclib/Crypt/RC2.php b/phpseclib/Crypt/RC2.php
@@ -346,6 +346,12 @@ function isValidEngine($engine)
     {
         switch ($engine) {
             case CRYPT_ENGINE_OPENSSL:
+                // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1
+                // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"
+                // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not
+                if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {
+                    return false;
+                }
                 if ($this->current_key_length != 128 || strlen($this->orig_key) < 16) {
                     return false;
                 }
diff --git a/phpseclib/Crypt/RC4.php b/phpseclib/Crypt/RC4.php
@@ -190,6 +190,12 @@ function Crypt_RC4()
     function isValidEngine($engine)
     {
         if ($engine == CRYPT_ENGINE_OPENSSL) {
+            // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1
+            // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"
+            // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not
+            if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {
+                return false;
+            }
             if (version_compare(PHP_VERSION, '5.3.7') >= 0) {
                 $this->cipher_name_openssl = 'rc4-40';
             } else {

Original file line number	Diff line number	Diff line change
`@@ -515,6 +515,12 @@ function setKeyLength($length)`
`515`	`515`	`function isValidEngine($engine)`
`516`	`516`	`{`
`517`	`517`	`if ($engine == CRYPT_ENGINE_OPENSSL) {`
	`518`	`+ // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1`
	`519`	`+ // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"`
	`520`	`+ // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not`
	`521`	`+ if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {`
	`522`	`+ return false;`
	`523`	`+ }`
`518`	`524`	`if (version_compare(PHP_VERSION, '5.3.7') < 0 && $this->key_length != 16) {`
`519`	`525`	`return false;`
`520`	`526`	`}`
Original file line number	Diff line number	Diff line change
`@@ -665,6 +665,12 @@ function isValidEngine($engine)`
`665`	`665`	`{`
`666`	`666`	`if ($this->key_length_max == 8) {`
`667`	`667`	`if ($engine == CRYPT_ENGINE_OPENSSL) {`
	`668`	`+ // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1`
	`669`	`+ // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"`
	`670`	`+ // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not`
	`671`	`+ if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {`
	`672`	`+ return false;`
	`673`	`+ }`
`668`	`674`	`$this->cipher_name_openssl_ecb = 'des-ecb';`
`669`	`675`	`$this->cipher_name_openssl = 'des-' . $this->_openssl_translate_mode();`
`670`	`676`	`}`
Original file line number	Diff line number	Diff line change
`@@ -346,6 +346,12 @@ function isValidEngine($engine)`
`346`	`346`	`{`
`347`	`347`	`switch ($engine) {`
`348`	`348`	`case CRYPT_ENGINE_OPENSSL:`
	`349`	`+ // quoting https://www.openssl.org/news/openssl-3.0-notes.html, OpenSSL 3.0.1`
	`350`	`+ // "Moved all variations of the EVP ciphers CAST5, BF, IDEA, SEED, RC2, RC4, RC5, and DES to the legacy provider"`
	`351`	`+ // in theory openssl_get_cipher_methods() should catch this but, on GitHub Actions, at least, it does not`
	`352`	`+ if (version_compare(preg_replace('#OpenSSL (\d+\.\d+\.\d+) .*#', '$1', OPENSSL_VERSION_TEXT), '3.0.1', '>=')) {`
	`353`	`+ return false;`
	`354`	`+ }`
`349`	`355`	`if ($this->current_key_length != 128 \|\| strlen($this->orig_key) < 16) {`
`350`	`356`	`return false;`
`351`	`357`	`}`