matrixorigin / matrixorigin/matrixone

[Compatibility]: AES_ENCRYPT supports only 2 of MySQL's 18 block encryption modes

Open
#28,223 0 comments 0 reactions 1 assignee Claimed by @XuPeng-SH View on GitHub
kind/bug needs-triage
Dominant language
Go
Stars
1.9k
Forks
311
Avg merge
1d 3h
Merged PRs (30d)
768

Description

### Is there an existing issue for the same bug?

- [x] I have checked the existing issues.

No issue was found for the missing `block_encryption_mode` execution modes.

### Branch Name

main

### Commit ID

`e7bb0572235ec4bac81eb098eb0ad8900f0065ab`

### Other Environment Information

- Local standalone MatrixOne
- Reference: MySQL 8.3.0

### Actual Behavior

MatrixOne accepts all tested MySQL `block_encryption_mode` values as a session variable, but `AES_ENCRYPT()` returns `NULL` for 16 of the 18 valid modes. Only `aes-128-ecb` and `aes-256-cbc` execute.

Unsupported valid modes are:

```text
aes-128-cbc, aes-128-cfb1, aes-128-cfb8, aes-128-cfb128, aes-128-ofb
aes-192-ecb, aes-192-cbc, aes-192-cfb1, aes-192-cfb8, aes-192-cfb128, aes-192-ofb
aes-256-ecb, aes-256-cfb1, aes-256-cfb8, aes-256-cfb128, aes-256-ofb
```

Example:

```sql
SET block_encryption_mode='aes-128-cbc';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
-- MatrixOne: NULL
-- MySQL: 69A6F153AF542950DAA1C3BB5801EE3C

SET block_encryption_mode='aes-192-ecb';
SELECT HEX(AES_ENCRYPT('hello','key'));
-- MatrixOne: NULL
-- MySQL: 0B2A7FC5426D8F24265EC1224F3B08DB

SET block_encryption_mode='aes-128-cfb8';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
-- MatrixOne: NULL
-- MySQL: 28E7E5B73C
```

Each mode was selected and used for encryption/decryption in three runs. The two implemented modes produced the same ciphertext and round-trip plaintext as MySQL.

### Expected Behavior

Every `block_encryption_mode` value accepted by MySQL should execute with its corresponding key size and block/stream mode. If MatrixOne does not support a mode, the system variable assignment should not silently accept it and turn later encryption calls into `NULL`.

### Steps to Reproduce

```sql
SET block_encryption_mode='aes-128-cbc';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));

SET block_encryption_mode='aes-192-ecb';
SELECT HEX(AES_ENCRYPT('hello','key'));

SET block_encryption_mode='aes-128-cfb8';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
```

### Additional information

`getAESMode` recognizes only `aes-128-ecb` and `aes-256-cbc`. Any other string returns an internal unsupported-mode error, which `AESEncrypt`/`AESDecrypt` convert to a null result.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.