matrixorigin / matrixorigin/matrixone
[Compatibility]: AES_ENCRYPT supports only 2 of MySQL's 18 block encryption modes
- Dominant language
- Go
- Stars
- 1.9k
- Forks
- 311
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 768
Description
### Is there an existing issue for the same bug?
- [x] I have checked the existing issues.
No issue was found for the missing `block_encryption_mode` execution modes.
### Branch Name
main
### Commit ID
`e7bb0572235ec4bac81eb098eb0ad8900f0065ab`
### Other Environment Information
- Local standalone MatrixOne
- Reference: MySQL 8.3.0
### Actual Behavior
MatrixOne accepts all tested MySQL `block_encryption_mode` values as a session variable, but `AES_ENCRYPT()` returns `NULL` for 16 of the 18 valid modes. Only `aes-128-ecb` and `aes-256-cbc` execute.
Unsupported valid modes are:
```text
aes-128-cbc, aes-128-cfb1, aes-128-cfb8, aes-128-cfb128, aes-128-ofb
aes-192-ecb, aes-192-cbc, aes-192-cfb1, aes-192-cfb8, aes-192-cfb128, aes-192-ofb
aes-256-ecb, aes-256-cfb1, aes-256-cfb8, aes-256-cfb128, aes-256-ofb
```
Example:
```sql
SET block_encryption_mode='aes-128-cbc';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
-- MatrixOne: NULL
-- MySQL: 69A6F153AF542950DAA1C3BB5801EE3C
SET block_encryption_mode='aes-192-ecb';
SELECT HEX(AES_ENCRYPT('hello','key'));
-- MatrixOne: NULL
-- MySQL: 0B2A7FC5426D8F24265EC1224F3B08DB
SET block_encryption_mode='aes-128-cfb8';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
-- MatrixOne: NULL
-- MySQL: 28E7E5B73C
```
Each mode was selected and used for encryption/decryption in three runs. The two implemented modes produced the same ciphertext and round-trip plaintext as MySQL.
### Expected Behavior
Every `block_encryption_mode` value accepted by MySQL should execute with its corresponding key size and block/stream mode. If MatrixOne does not support a mode, the system variable assignment should not silently accept it and turn later encryption calls into `NULL`.
### Steps to Reproduce
```sql
SET block_encryption_mode='aes-128-cbc';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
SET block_encryption_mode='aes-192-ecb';
SELECT HEX(AES_ENCRYPT('hello','key'));
SET block_encryption_mode='aes-128-cfb8';
SELECT HEX(AES_ENCRYPT('hello','key','0123456789abcdef'));
```
### Additional information
`getAESMode` recognizes only `aes-128-ecb` and `aes-256-cbc`. Any other string returns an internal unsupported-mode error, which `AESEncrypt`/`AESDecrypt` convert to a null result.
Contributor guide
Assessment
This issue has not been assessed yet.