Description

openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password cracking at SHA-256 speed instead of the configured KDF cost.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-17T11:16:41.427Z",
  "pubdate": "2026-08-17T11:16:41.427Z",
  "executiveSummary": "A critical key derivation flaw exists in openssl_encrypt versions prior to 1.4.6, specifically residing within the sequential XOR composition mode. This cryptographic vulnerability compromises the security guarantees of memory-hard key derivation functions by causing the final stage of key generation to cancel out under specific configurations. The primary impact is the complete bypass of intended computational work factors for password hashing, reducing the security posture to that of a raw hash function. The vulnerability affects systems utilizing openssl_encrypt configured with a single KDF and lacking a prior hashing stage. Attackers capable of intercepting or obtaining the derived key material or password hash equivalents can leverage this weakness to execute offline password cracking attacks. Instead of incurring the high computational and memory costs mandated by the configured KDF, adversaries can perform brute-force or dictionary attacks at the raw performance speed of SHA-256. This drastically lowers the economic and temporal barrier for threat actors to recover plaintext passwords from compromised authentication data stores. Consequently, any deployment relying on the affected software version for secure password storage or cryptographic key stretching is at severe risk of credential compromise.",
  "technicalDetails": "The vulnerability stems from a logical flaw in the sequential XOR composition mode implemented during key generation within openssl_encrypt versions prior to 1.4.6. The root cause is mathematical cancellation occurring in the final stage of the sequential XOR composition, which inadvertently neutralizes the intended algorithmic transformations when the system is operating under a specific configuration profile. Specifically, when openssl_encrypt is instantiated with a single Key Derivation Function (KDF) and omits any preliminary hashing stage, the composition logic fails to correctly chain the intermediate states. Consequently, the output key material does not reflect the iterations, memory hardness, or computational complexity designed into the KDF. Instead, the execution path collapses to a deterministic operation equivalent to SHA-256 processing speeds. Attackers exploit this flaw by targeting deployments running vulnerable versions where administrative configurations omit the preparatory hashing phase and rely on a single KDF instance. The step-by-step attack flow begins with the adversary acquiring a dataset containing the output of the flawed key derivation process, typically harvested from a database dump or configuration file. Recognizing the deployment parameters, the attacker bypasses the computationally expensive resource constraints—such as high memory allocation and CPU cycles—that would normally protect against brute-force enumeration. The adversary then mounts an offline password cracking campaign, utilizing massively parallel hardware such as GPUs or specialized ASIC clusters to test candidate passwords against the compromised derivation routine. Because the security margin is reduced to SHA-256 speed, the attack executes exponentially faster than intended, rendering the password storage mechanism ineffective against modern cracking techniques. The vulnerable component is the sequential XOR composition routine handling key generation logic. The affected software scope is strictly constrained to openssl_encrypt versions prior to 1.4.6. Successful exploitation requires access to the derived key artifacts or cryptographic outputs for offline analysis, but does not necessitate active network exposure, authentication privileges, or elevated system access on the host platform."
}