Description

openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with iterations=1 per call in an outer loop, creating a KDF whose security properties have not been formally analyzed. Attackers can exploit this weakened key derivation to more efficiently crack passwords protecting legacy encrypted files compared to standard PBKDF2 implementations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T11:16:43.653Z",
  "pubdate": "2026-08-17T11:16:43.653Z",
  "executiveSummary": "A cryptographic weakness exists in openssl_encrypt versions before 1.4.0 due to the utilization of a non-standard Password-Based Key Derivation Function 2 (PBKDF2) construction. Specifically, the implementation executes with iterations=1 per call within an outer loop, deviating from standard cryptographic best practices and yielding a key derivation function lacking formal security analysis.\nThe primary impact of this vulnerability is the substantial reduction of computational complexity required to derive cryptographic keys from user-supplied passwords. Consequently, threat actors can leverage offline brute-force or dictionary attacks to significantly accelerate the cracking of passwords protecting legacy encrypted files.\nAffected systems include deployments utilizing openssl_encrypt prior to version 1.4.0. The risk implication is compromised confidentiality of encrypted data at rest. Attackers require access to the legacy encrypted files and possess the capability to perform offline cryptanalytic attacks against the weakened derived keys. No specific authentication, privileges, or network exposure are required for the exploitation phase, as the attack operates against intercepted or obtained static ciphertext artifacts.",
  "technicalDetails": "The vulnerability resides in the cryptographic key derivation component of openssl_encrypt prior to version 1.4.0. The root cause is the implementation of a proprietary and non-standard PBKDF2 construction that enforces iterations=1 per call within an outer loop structure. Standard PBKDF2 implementations rely on a high configurable iteration count to artificially increase the computational cost of brute-force and dictionary attacks, thereby mitigating the risk of rapid password recovery.\nBy reducing the effective iteration workload, the vulnerable mechanism drastically decreases the time and computational resources required to test candidate passwords. The exploitation method is strictly offline and passive, requiring the adversary to obtain a copy of the legacy encrypted file generated by the vulnerable software.\nThe step-by-step attack flow proceeds as follows: First, the attacker acquires the legacy encrypted file containing the ciphertext and associated cryptographic metadata, such as the salt and initialization vector. Second, the attacker initiates an offline cryptanalytic attack, systematically testing potential plaintext passwords or utilizing precomputed dictionary lists. Third, because the key derivation function executes with minimal computational overhead (iterations=1 per call), the key derivation process evaluates at high speeds. Fourth, upon successfully deriving the correct cryptographic key, the attacker decrypts the ciphertext to access sensitive plaintext data contained within the legacy file.\nThe vulnerable component is the key derivation routine within openssl_encrypt. Affected versions include all releases prior to 1.4.0. The vulnerability does not require authentication, privileges, or active network exposure for exploitation, as the cryptographic weakness is inherent to the static derivation parameters embedded in the legacy encryption scheme."
}