Support non-standard AES-GCM nonce and tag sizes when using the CNG and OpenSSL backends
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 431
- Forks
- 44
- Avg merge
- 21h 18m
- Merged PRs (30d)
- 30
Description
We currently fall back to Go crypto if the AES-GCM nonce size is not 12 or when the tag size is not 16:
https://github.com/golang-fips/openssl/blob/eb155dada337b0de53873aa42e89724ad59aa768/cipher.go#L358-L363
https://github.com/microsoft/go-crypto-winnative/blob/b49854c00e37c07d57cec6983adbec6ae9a0aa73/cng/aes.go#L107-L112
Either CNG and OpenSSL support more nonce and tag sizes. We should avoid falling back whenever possible.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the fallback logic in cipher.go around lines 358-363 and cng/aes.go around lines 107-112, then inspect the CNG and OpenSSL AES-GCM capabilities for supported nonce and tag sizes. Done means both backends avoid falling back to Go crypto whenever their native APIs support the requested sizes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, cryptography, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100