On Mon, Mar 14, 2016, Blumenthal, Uri - 0553 - MITLL wrote: > On 3/14/16, 14:45, "openssl-dev on behalf of Viktor Dukhovni" > <openssl-dev-boun...@openssl.org on behalf of openssl-us...@dukhovni.org> > wrote: > > >On Mon, Mar 14, 2016 at 05:45:34PM +0000, Stephan Mühlstrasser via RT > >wrote: > >> I had written a message about this issue to openssl-users, but received > >> no reaction. > > > >IIRC RC4 (more generally all stream ciphers) are not supported with > >CMS, and the bug is that OpenSSL allowed you to use RC4, not that > >the result failed to decrypt. > > Is there any reason why stream ciphers are not supported with CMS? >
Well one reason is that I'm not aware of any standard which defines how to use stream ciphers with CMS. OpenSSL should really reject these with an appropriate error. > Along the same line, is there any reason why AE(AD) ciphers are not > supported with ???openssl enc???? > The require additional handling such setting parameters and how to handle the tag. That functionality is not currently present in the enc utility. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
