class XMLSecurityKey and type http://www.w3.org/2009/xmlenc11#aes256-gcm

[kotsis]

Hello there,

I got this exception "Could not locate key algorithm in encrypted data" from the following code:
$attrAlgorithm = "http://www.w3.org/2009/xmlenc11#aes256-gcm";
$objKey = new XMLSecurityKey($attrAlgorithm, array('type' => 'private'));

Is it possible for me to add support easily? I understand the php mcrypt library does not support GCM.
Perhaps through openssl?

Best regards,
Kostas

[robrichards]

@kotsis The recent 3.0 release dropped mcrypt for pure openssl so this should you should be able to add the support without much difficulty

There are two options at the moment as far as I see it:

1. Use PHP >= 7.1 which supports tag/aad parameters to openssl_decrypt and openssl_encrypt;
2. Use php-sodium, php-pecl-libsodium or paragonie/sodium_compat, and use the AES-256-GCM support there, see https://paragonie.com/book/pecl-libsodium/read/08-advanced.md#crypto-aead-aes256gcm

Option 1 is easiest, option 2 allows supporting older versions of PHP, even as far back as PHP 5.4 (CentOS 7) and possibly further.

I was looking into using this and using GCM is pretty easy. Just like with CBC you put the IV (nonce) in front of the ciphertext and the tag at the end (already done by libsodium) or easily done manually with openssl_encrypt.

I just saw there is also this: https://github.com/Spomky-Labs/php-aes-gcm but that would drag in additional dependencies... not ideal.

I'd guess the best approach would be to only support AES-GCM on PHP >= 7.1 and just fail / not support it on older PHPs.