diff --git a/contrib/pgcrypto/expected/pgp-decrypt.out b/contrib/pgcrypto/expected/pgp-decrypt.out index 8ce6466f2e9..cd62d52242b 100644 --- a/contrib/pgcrypto/expected/pgp-decrypt.out +++ b/contrib/pgcrypto/expected/pgp-decrypt.out @@ -439,3 +439,29 @@ UCAAw2JRIISttRHMfDpDuZJpvYo= '), 'key', 'debug=1'); NOTICE: dbg: parse_compressed_data: bzip2 unsupported ERROR: Unsupported compression algorithm +-- Check ignore-cipher-failure. This message isn't actually encrypted; it was +-- created with cipher-algo=bf using an OpenSSL that didn't actually support +-- Blowfish. After the fix for CVE-2026-14663, we no longer create these broken +-- ciphertexts, but we allow users to return to the previous behavior during +-- decryption so that the bad wrapper can be stripped. +-- +-- Note that if Blowfish is supported by the linked OpenSSL, both decryptions +-- will fail. +select pgp_sym_decrypt(dearmor(' +-----BEGIN PGP MESSAGE----- + +ww0EBAMC8wIKbtvzJtxi0jABUleCwFJWGCkYKcsNdABqdtXaU2VjcmV0LtMUlnPH3A2QBmZrcucm +1GPb/s2Bkdg= +=6aqD +-----END PGP MESSAGE----- +'), 'wrong key'); +ERROR: Wrong key or corrupt data +select pgp_sym_decrypt(dearmor(' +-----BEGIN PGP MESSAGE----- + +ww0EBAMC8wIKbtvzJtxi0jABUleCwFJWGCkYKcsNdABqdtXaU2VjcmV0LtMUlnPH3A2QBmZrcucm +1GPb/s2Bkdg= +=6aqD +-----END PGP MESSAGE----- +'), 'wrong key', 'ignore-cipher-failure=1'); +ERROR: Wrong key or corrupt data diff --git a/contrib/pgcrypto/expected/pgp-decrypt_1.out b/contrib/pgcrypto/expected/pgp-decrypt_1.out index 7d3a820e0b1..df4d28872b5 100644 --- a/contrib/pgcrypto/expected/pgp-decrypt_1.out +++ b/contrib/pgcrypto/expected/pgp-decrypt_1.out @@ -435,3 +435,33 @@ UCAAw2JRIISttRHMfDpDuZJpvYo= '), 'key', 'debug=1'); NOTICE: dbg: parse_compressed_data: bzip2 unsupported ERROR: Unsupported compression algorithm +-- Check ignore-cipher-failure. This message isn't actually encrypted; it was +-- created with cipher-algo=bf using an OpenSSL that didn't actually support +-- Blowfish. After the fix for CVE-2026-14663, we no longer create these broken +-- ciphertexts, but we allow users to return to the previous behavior during +-- decryption so that the bad wrapper can be stripped. +-- +-- Note that if Blowfish is supported by the linked OpenSSL, both decryptions +-- will fail. +select pgp_sym_decrypt(dearmor(' +-----BEGIN PGP MESSAGE----- + +ww0EBAMC8wIKbtvzJtxi0jABUleCwFJWGCkYKcsNdABqdtXaU2VjcmV0LtMUlnPH3A2QBmZrcucm +1GPb/s2Bkdg= +=6aqD +-----END PGP MESSAGE----- +'), 'wrong key'); +ERROR: encrypt error: Cipher cannot be initialized +select pgp_sym_decrypt(dearmor(' +-----BEGIN PGP MESSAGE----- + +ww0EBAMC8wIKbtvzJtxi0jABUleCwFJWGCkYKcsNdABqdtXaU2VjcmV0LtMUlnPH3A2QBmZrcucm +1GPb/s2Bkdg= +=6aqD +-----END PGP MESSAGE----- +'), 'wrong key', 'ignore-cipher-failure=1'); + pgp_sym_decrypt +----------------- + Secret. +(1 row) + diff --git a/contrib/pgcrypto/expected/pgp-info.out b/contrib/pgcrypto/expected/pgp-info.out index 90648383730..909e7f7851e 100644 --- a/contrib/pgcrypto/expected/pgp-info.out +++ b/contrib/pgcrypto/expected/pgp-info.out @@ -75,5 +75,6 @@ from encdata order by id; B68504FD128E1FF9 FD0206C409B74875 FD0206C409B74875 -(5 rows) + D936CF64BB73F466 +(6 rows) diff --git a/contrib/pgcrypto/expected/pgp-pubkey-decrypt.out b/contrib/pgcrypto/expected/pgp-pubkey-decrypt.out index b4b6810a3c5..d3bb5f1b06d 100644 --- a/contrib/pgcrypto/expected/pgp-pubkey-decrypt.out +++ b/contrib/pgcrypto/expected/pgp-pubkey-decrypt.out @@ -585,6 +585,20 @@ blH2nKZC9d6fi4YzSYMepZpMOFR65M80MCMiDUGnZBB8sEADu2/iVtqDUeG8mAA= =PHJ1 -----END PGP MESSAGE----- '); +-- CVE-2026-14663. This message was created with cipher-algo=bf using an OpenSSL +-- that didn't actually support Blowfish. +insert into encdata (id, data) values (6, ' +-----BEGIN PGP MESSAGE----- + +wcBOA9k2z2S7c/RmEAP8DYbU6AeEo6riMMdnf2G62BM9gC0Z32ODydewy3Ki8AnSzpwBDAHuDMcr +P6RJDWvBOVOwgxHEwR7ZHMoFRDJEXdo6rQ9dQpDtbasMLyi6Lm1q+PbEefVd9WkU7fvFAFQx8k3t +lxrlWg/byoNplc7/hFxIFO8bN+FIlLgilAdApNcD/3Mg2/nd7pczovsYoryf9ib04kQ+SVWs3iNE +StoyEXT+oaT8u1vAxiY7fzPpQX1pnlHBUXn+v1J6LQL5Bwi5CTqOyDSyaFfgU0gQwTReFjS6L4Fs +Cv+2cFwbJBGIzr1aI4DLbzSelkmVm4hbOVeET4DJVlUVhhIyy6ZfoXiTEG6s0jMB2JdRGIl0EUQR +RMsQdABqdt5jU2VjcmV0IG1zZ9MUIIP4SPiU2pM/nF/A1hrltMhn/ZI= +=Mkdj +-----END PGP MESSAGE----- +'); -- successful decrypt select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=1 and encdata.id=1; @@ -600,6 +614,13 @@ from keytbl, encdata where keytbl.id=2 and encdata.id=2; Secret msg (1 row) +select pgp_pub_decrypt(dearmor(data), dearmor(seckey), '', 'ignore-cipher-failure=1') +from keytbl, encdata where keytbl.id=2 and encdata.id=2; + pgp_pub_decrypt +----------------- + Secret msg +(1 row) + select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=3 and encdata.id=3; pgp_pub_decrypt @@ -654,3 +675,12 @@ from keytbl, encdata where keytbl.id=5 and encdata.id=1; select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=6 and encdata.id=5; ERROR: Wrong key or corrupt data +-- Check that ignore-cipher-failure can strip faulty encryption if OpenSSL +-- doesn't support the cipher. (The decryption will correctly fail both times if +-- OpenSSL does support it.) +select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) +from keytbl, encdata where keytbl.id=1 and encdata.id=6; +ERROR: Wrong key or corrupt data +select pgp_pub_decrypt(dearmor(data), dearmor(seckey), '', 'ignore-cipher-failure=1') +from keytbl, encdata where keytbl.id=1 and encdata.id=6; +ERROR: Wrong key or corrupt data diff --git a/contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out b/contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out index 7e2e1f98fca..ac9307daf5e 100644 --- a/contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out +++ b/contrib/pgcrypto/expected/pgp-pubkey-decrypt_1.out @@ -585,6 +585,20 @@ blH2nKZC9d6fi4YzSYMepZpMOFR65M80MCMiDUGnZBB8sEADu2/iVtqDUeG8mAA= =PHJ1 -----END PGP MESSAGE----- '); +-- CVE-2026-14663. This message was created with cipher-algo=bf using an OpenSSL +-- that didn't actually support Blowfish. +insert into encdata (id, data) values (6, ' +-----BEGIN PGP MESSAGE----- + +wcBOA9k2z2S7c/RmEAP8DYbU6AeEo6riMMdnf2G62BM9gC0Z32ODydewy3Ki8AnSzpwBDAHuDMcr +P6RJDWvBOVOwgxHEwR7ZHMoFRDJEXdo6rQ9dQpDtbasMLyi6Lm1q+PbEefVd9WkU7fvFAFQx8k3t +lxrlWg/byoNplc7/hFxIFO8bN+FIlLgilAdApNcD/3Mg2/nd7pczovsYoryf9ib04kQ+SVWs3iNE +StoyEXT+oaT8u1vAxiY7fzPpQX1pnlHBUXn+v1J6LQL5Bwi5CTqOyDSyaFfgU0gQwTReFjS6L4Fs +Cv+2cFwbJBGIzr1aI4DLbzSelkmVm4hbOVeET4DJVlUVhhIyy6ZfoXiTEG6s0jMB2JdRGIl0EUQR +RMsQdABqdt5jU2VjcmV0IG1zZ9MUIIP4SPiU2pM/nF/A1hrltMhn/ZI= +=Mkdj +-----END PGP MESSAGE----- +'); -- successful decrypt select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=1 and encdata.id=1; @@ -596,6 +610,9 @@ from keytbl, encdata where keytbl.id=1 and encdata.id=1; select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=2 and encdata.id=2; ERROR: encrypt error: Cipher cannot be initialized +select pgp_pub_decrypt(dearmor(data), dearmor(seckey), '', 'ignore-cipher-failure=1') +from keytbl, encdata where keytbl.id=2 and encdata.id=2; +ERROR: Wrong key or corrupt data select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=3 and encdata.id=3; pgp_pub_decrypt @@ -650,3 +667,16 @@ from keytbl, encdata where keytbl.id=5 and encdata.id=1; select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=6 and encdata.id=5; ERROR: Wrong key or corrupt data +-- Check that ignore-cipher-failure can strip faulty encryption if OpenSSL +-- doesn't support the cipher. (The decryption will correctly fail both times if +-- OpenSSL does support it.) +select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) +from keytbl, encdata where keytbl.id=1 and encdata.id=6; +ERROR: encrypt error: Cipher cannot be initialized +select pgp_pub_decrypt(dearmor(data), dearmor(seckey), '', 'ignore-cipher-failure=1') +from keytbl, encdata where keytbl.id=1 and encdata.id=6; + pgp_pub_decrypt +----------------- + Secret msg +(1 row) + diff --git a/contrib/pgcrypto/pgp-cfb.c b/contrib/pgcrypto/pgp-cfb.c index e6ae3a49244..c81534bf1ef 100644 --- a/contrib/pgcrypto/pgp-cfb.c +++ b/contrib/pgcrypto/pgp-cfb.c @@ -43,6 +43,7 @@ struct PGP_CFB int pos; int block_no; int resync; + int ignore_decrypt_cipher_failure; /* for CVE-2026-14663 recovery */ uint8 fr[PGP_MAX_BLOCK]; uint8 fre[PGP_MAX_BLOCK]; uint8 encbuf[PGP_MAX_BLOCK]; @@ -50,7 +51,7 @@ struct PGP_CFB int pgp_cfb_create(PGP_CFB **ctx_p, int algo, const uint8 *key, int key_len, - int resync, uint8 *iv) + int resync, uint8 *iv, int ignore_decrypt_cipher_failure) { int res; PX_Cipher *ciph; @@ -71,6 +72,7 @@ pgp_cfb_create(PGP_CFB **ctx_p, int algo, const uint8 *key, int key_len, ctx->ciph = ciph; ctx->block_size = px_cipher_block_size(ciph); ctx->resync = resync; + ctx->ignore_decrypt_cipher_failure = ignore_decrypt_cipher_failure; if (iv) memcpy(ctx->fr, iv, ctx->block_size); @@ -195,7 +197,7 @@ mix_decrypt_resync(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst) */ static int cfb_process(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst, - mix_data_t mix_data) + mix_data_t mix_data, int ignore_cipher_failure) { int n; int res; @@ -224,7 +226,14 @@ cfb_process(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst, int err; err = px_cipher_encrypt(ctx->ciph, 0, ctx->fr, ctx->block_size, ctx->fre, &rlen); - if (err) + + /* + * XXX Ignoring cipher failures is dangerous, but we allow it during + * decryption to return to the behavior prior to the fix for + * CVE-2026-14663. This lets users recover data from a badly-encrypted + * message. + */ + if (err && !ignore_cipher_failure) ereport(ERROR, (errcode(ERRCODE_EXTERNAL_ROUTINE_INVOCATION_EXCEPTION), errmsg("encrypt error: %s", px_strerror(err)))); @@ -259,7 +268,8 @@ pgp_cfb_encrypt(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst) { mix_data_t mix = ctx->resync ? mix_encrypt_resync : mix_encrypt_normal; - return cfb_process(ctx, data, len, dst, mix); + return cfb_process(ctx, data, len, dst, mix, + 0 /* never ignore cipher failures for encrypt */ ); } int @@ -267,5 +277,6 @@ pgp_cfb_decrypt(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst) { mix_data_t mix = ctx->resync ? mix_decrypt_resync : mix_decrypt_normal; - return cfb_process(ctx, data, len, dst, mix); + return cfb_process(ctx, data, len, dst, mix, + ctx->ignore_decrypt_cipher_failure); } diff --git a/contrib/pgcrypto/pgp-decrypt.c b/contrib/pgcrypto/pgp-decrypt.c index e1ea5b3e58d..887fbc19278 100644 --- a/contrib/pgcrypto/pgp-decrypt.c +++ b/contrib/pgcrypto/pgp-decrypt.c @@ -595,7 +595,8 @@ decrypt_key(PGP_Context *ctx, const uint8 *src, int len) PGP_CFB *cfb; res = pgp_cfb_create(&cfb, ctx->s2k_cipher_algo, - ctx->s2k.key, ctx->s2k.key_len, 0, NULL); + ctx->s2k.key, ctx->s2k.key_len, 0, NULL, + ctx->ignore_cipher_failure); if (res < 0) return res; @@ -983,7 +984,8 @@ parse_symenc_data(PGP_Context *ctx, PullFilter *pkt, MBuf *dst) PullFilter *pf_prefix = NULL; res = pgp_cfb_create(&cfb, ctx->cipher_algo, - ctx->sess_key, ctx->sess_key_len, 1, NULL); + ctx->sess_key, ctx->sess_key_len, 1, NULL, + ctx->ignore_cipher_failure); if (res < 0) goto out; @@ -1026,7 +1028,8 @@ parse_symenc_mdc_data(PGP_Context *ctx, PullFilter *pkt, MBuf *dst) } res = pgp_cfb_create(&cfb, ctx->cipher_algo, - ctx->sess_key, ctx->sess_key_len, 0, NULL); + ctx->sess_key, ctx->sess_key_len, 0, NULL, + ctx->ignore_cipher_failure); if (res < 0) goto out; diff --git a/contrib/pgcrypto/pgp-encrypt.c b/contrib/pgcrypto/pgp-encrypt.c index f7467c9b1cb..968e8c92ce4 100644 --- a/contrib/pgcrypto/pgp-encrypt.c +++ b/contrib/pgcrypto/pgp-encrypt.c @@ -174,7 +174,8 @@ encrypt_init(PushFilter *next, void *init_arg, void **priv_p) return res; } res = pgp_cfb_create(&ciph, ctx->cipher_algo, - ctx->sess_key, ctx->sess_key_len, resync, NULL); + ctx->sess_key, ctx->sess_key_len, resync, NULL, + 0 /* never ignore cipher failures for encrypt */ ); if (res < 0) return res; @@ -505,7 +506,8 @@ symencrypt_sesskey(PGP_Context *ctx, uint8 *dst) uint8 algo = ctx->cipher_algo; res = pgp_cfb_create(&cfb, ctx->s2k_cipher_algo, - ctx->s2k.key, ctx->s2k.key_len, 0, NULL); + ctx->s2k.key, ctx->s2k.key_len, 0, NULL, + 0 /* never ignore cipher failures for encrypt */ ); if (res < 0) return res; diff --git a/contrib/pgcrypto/pgp-pgsql.c b/contrib/pgcrypto/pgp-pgsql.c index 464ca6e06c9..c9d10a27f1d 100644 --- a/contrib/pgcrypto/pgp-pgsql.c +++ b/contrib/pgcrypto/pgp-pgsql.c @@ -192,6 +192,8 @@ set_arg(PGP_Context *ctx, char *key, char *val, res = pgp_set_convert_crlf(ctx, atoi(val)); else if (strcmp(key, "unicode-mode") == 0) res = pgp_set_unicode_mode(ctx, atoi(val)); + else if (strcmp(key, "ignore-cipher-failure") == 0) + res = pgp_set_ignore_cipher_failure(ctx, atoi(val)); /* * The remaining options are for debugging/testing and are therefore not diff --git a/contrib/pgcrypto/pgp-pubkey.c b/contrib/pgcrypto/pgp-pubkey.c index 9a6561caf9d..470e0debbb0 100644 --- a/contrib/pgcrypto/pgp-pubkey.c +++ b/contrib/pgcrypto/pgp-pubkey.c @@ -382,8 +382,15 @@ process_secret_key(PullFilter *pkt, PGP_PubKey **pk_p, /* * create decrypt filter + * + * ignore-cipher-failure doesn't apply here; pgcrypto didn't encrypt + * the secret key to begin with, and any stored encrypted data was + * generated using the public key, so users don't have a reason to + * want to incorrectly decrypt this. We'll ignore failures during + * decryption with the session key, instead. */ - res = pgp_cfb_create(&cfb, cipher_algo, s2k.key, s2k.key_len, 0, iv); + res = pgp_cfb_create(&cfb, cipher_algo, s2k.key, s2k.key_len, 0, iv, + 0 /* don't ignore cipher failures */ ); if (res < 0) return res; res = pullf_create(&pf_decrypt, &pgp_decrypt_filter, cfb, pkt); diff --git a/contrib/pgcrypto/pgp.c b/contrib/pgcrypto/pgp.c index 8a6a6c2adf1..cf3fff90fa2 100644 --- a/contrib/pgcrypto/pgp.c +++ b/contrib/pgcrypto/pgp.c @@ -49,6 +49,7 @@ static int def_use_sess_key = 0; static int def_text_mode = 0; static int def_unicode_mode = 0; static int def_convert_crlf = 0; +static int def_ignore_cipher_failure = 0; struct digest_info { @@ -204,6 +205,7 @@ pgp_init(PGP_Context **ctx_p) ctx->unicode_mode = def_unicode_mode; ctx->convert_crlf = def_convert_crlf; ctx->text_mode = def_text_mode; + ctx->ignore_cipher_failure = def_ignore_cipher_failure; *ctx_p = ctx; return 0; @@ -349,6 +351,13 @@ pgp_set_unicode_mode(PGP_Context *ctx, int mode) return 0; } +int +pgp_set_ignore_cipher_failure(PGP_Context *ctx, int ignore) +{ + ctx->ignore_cipher_failure = ignore ? 1 : 0; + return 0; +} + int pgp_set_symkey(PGP_Context *ctx, const uint8 *key, int len) { diff --git a/contrib/pgcrypto/pgp.h b/contrib/pgcrypto/pgp.h index 0bbfd0217ba..7b130388fcc 100644 --- a/contrib/pgcrypto/pgp.h +++ b/contrib/pgcrypto/pgp.h @@ -150,6 +150,9 @@ struct PGP_Context int convert_crlf; int unicode_mode; + /* DANGEROUS recovery aid for CVE-2026-14663. Applies only to decryption. */ + int ignore_cipher_failure; + /* * internal variables */ @@ -258,6 +261,7 @@ int pgp_set_compress_level(PGP_Context *ctx, int level); int pgp_set_text_mode(PGP_Context *ctx, int mode); int pgp_set_unicode_mode(PGP_Context *ctx, int mode); int pgp_get_unicode_mode(PGP_Context *ctx); +int pgp_set_ignore_cipher_failure(PGP_Context *ctx, int ignore); int pgp_set_symkey(PGP_Context *ctx, const uint8 *key, int len); int pgp_set_pubkey(PGP_Context *ctx, MBuf *keypkt, @@ -278,7 +282,8 @@ int pgp_s2k_process(PGP_S2K *s2k, int cipher, const uint8 *key, int key_len); typedef struct PGP_CFB PGP_CFB; int pgp_cfb_create(PGP_CFB **ctx_p, int algo, - const uint8 *key, int key_len, int resync, uint8 *iv); + const uint8 *key, int key_len, int resync, uint8 *iv, + int ignore_decrypt_cipher_failure); void pgp_cfb_free(PGP_CFB *ctx); int pgp_cfb_encrypt(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst); int pgp_cfb_decrypt(PGP_CFB *ctx, const uint8 *data, int len, uint8 *dst); diff --git a/contrib/pgcrypto/sql/pgp-decrypt.sql b/contrib/pgcrypto/sql/pgp-decrypt.sql index b499bf757b0..7e7dc189e58 100644 --- a/contrib/pgcrypto/sql/pgp-decrypt.sql +++ b/contrib/pgcrypto/sql/pgp-decrypt.sql @@ -328,3 +328,29 @@ UCAAw2JRIISttRHMfDpDuZJpvYo= =AZ9M -----END PGP MESSAGE----- '), 'key', 'debug=1'); + +-- Check ignore-cipher-failure. This message isn't actually encrypted; it was +-- created with cipher-algo=bf using an OpenSSL that didn't actually support +-- Blowfish. After the fix for CVE-2026-14663, we no longer create these broken +-- ciphertexts, but we allow users to return to the previous behavior during +-- decryption so that the bad wrapper can be stripped. +-- +-- Note that if Blowfish is supported by the linked OpenSSL, both decryptions +-- will fail. +select pgp_sym_decrypt(dearmor(' +-----BEGIN PGP MESSAGE----- + +ww0EBAMC8wIKbtvzJtxi0jABUleCwFJWGCkYKcsNdABqdtXaU2VjcmV0LtMUlnPH3A2QBmZrcucm +1GPb/s2Bkdg= +=6aqD +-----END PGP MESSAGE----- +'), 'wrong key'); + +select pgp_sym_decrypt(dearmor(' +-----BEGIN PGP MESSAGE----- + +ww0EBAMC8wIKbtvzJtxi0jABUleCwFJWGCkYKcsNdABqdtXaU2VjcmV0LtMUlnPH3A2QBmZrcucm +1GPb/s2Bkdg= +=6aqD +-----END PGP MESSAGE----- +'), 'wrong key', 'ignore-cipher-failure=1'); diff --git a/contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql b/contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql index 3f2bae9e40b..40a11e0b2dc 100644 --- a/contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql +++ b/contrib/pgcrypto/sql/pgp-pubkey-decrypt.sql @@ -601,6 +601,21 @@ blH2nKZC9d6fi4YzSYMepZpMOFR65M80MCMiDUGnZBB8sEADu2/iVtqDUeG8mAA= -----END PGP MESSAGE----- '); +-- CVE-2026-14663. This message was created with cipher-algo=bf using an OpenSSL +-- that didn't actually support Blowfish. +insert into encdata (id, data) values (6, ' +-----BEGIN PGP MESSAGE----- + +wcBOA9k2z2S7c/RmEAP8DYbU6AeEo6riMMdnf2G62BM9gC0Z32ODydewy3Ki8AnSzpwBDAHuDMcr +P6RJDWvBOVOwgxHEwR7ZHMoFRDJEXdo6rQ9dQpDtbasMLyi6Lm1q+PbEefVd9WkU7fvFAFQx8k3t +lxrlWg/byoNplc7/hFxIFO8bN+FIlLgilAdApNcD/3Mg2/nd7pczovsYoryf9ib04kQ+SVWs3iNE +StoyEXT+oaT8u1vAxiY7fzPpQX1pnlHBUXn+v1J6LQL5Bwi5CTqOyDSyaFfgU0gQwTReFjS6L4Fs +Cv+2cFwbJBGIzr1aI4DLbzSelkmVm4hbOVeET4DJVlUVhhIyy6ZfoXiTEG6s0jMB2JdRGIl0EUQR +RMsQdABqdt5jU2VjcmV0IG1zZ9MUIIP4SPiU2pM/nF/A1hrltMhn/ZI= +=Mkdj +-----END PGP MESSAGE----- +'); + -- successful decrypt select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=1 and encdata.id=1; @@ -608,6 +623,9 @@ from keytbl, encdata where keytbl.id=1 and encdata.id=1; select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=2 and encdata.id=2; +select pgp_pub_decrypt(dearmor(data), dearmor(seckey), '', 'ignore-cipher-failure=1') +from keytbl, encdata where keytbl.id=2 and encdata.id=2; + select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=3 and encdata.id=3; @@ -645,3 +663,12 @@ from keytbl, encdata where keytbl.id=5 and encdata.id=1; -- test for a short read from prefix_init select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) from keytbl, encdata where keytbl.id=6 and encdata.id=5; + +-- Check that ignore-cipher-failure can strip faulty encryption if OpenSSL +-- doesn't support the cipher. (The decryption will correctly fail both times if +-- OpenSSL does support it.) +select pgp_pub_decrypt(dearmor(data), dearmor(seckey)) +from keytbl, encdata where keytbl.id=1 and encdata.id=6; + +select pgp_pub_decrypt(dearmor(data), dearmor(seckey), '', 'ignore-cipher-failure=1') +from keytbl, encdata where keytbl.id=1 and encdata.id=6; diff --git a/doc/src/sgml/pgcrypto.sgml b/doc/src/sgml/pgcrypto.sgml index b8b89696e7f..37eaaf833cb 100644 --- a/doc/src/sgml/pgcrypto.sgml +++ b/doc/src/sgml/pgcrypto.sgml @@ -921,6 +921,38 @@ Applies to: pgp_sym_encrypt Values: 0, 1 Default: 0 Applies to: pgp_sym_encrypt, pgp_pub_encrypt + + + + + ignore-cipher-failure + + + Dangerous! Instructs pgcrypto to use an incorrect decryption algorithm + matching the historical behavior prior to the fix for CVE-2026-14663, by + completely ignoring failures from the OpenSSL cipher in use. This is + intended only for users who need to recover incorrectly-encrypted messages + created when the cipher-algo was unavailable under the + OpenSSL configuration in use. Such faulty messages do not require the + correct decryption key when ignore-cipher-failure is + enabled, so there is no guarantee that the decrypted plaintext actually + originated from a holder of the key. + + + Contrast the case of a message which was correctly encrypted, but the cipher + that produced it is unavailable under the current OpenSSL + configuration. Recovering such plaintext via pgcrypto + requires making the actual cipher available to OpenSSL by, for example, + enabling the appropriate provider. ignore-cipher-failure + is not necessary or helpful for that scenario. If decryption + of a correctly encrypted message with this option happens to pass PGP + integrity checks, that result is coincidental and does not make the + recovered plaintext trustworthy. + + +Values: 0, 1 +Default: 0 +Applies to: pgp_sym_decrypt, pgp_pub_decrypt