Description

openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T11:16:43.803Z",
  "pubdate": "2026-08-17T11:16:43.803Z",
  "executiveSummary": "A cryptographic weakness has been identified in openssl_encrypt versions prior to 1.4.0, specifically residing within its key normalization functions.\nThe vulnerability stems from the implementation of the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) utilizing a null salt value alongside a static info parameter.\nThis improper usage significantly degrades the entropy extraction capabilities of the cryptographic function and introduces unacceptable levels of determinism into the key derivation process.\nConsequently, the compromised cryptographic security exposes systems to multi-target attacks, where attackers leverage the predictability of derived keys when processed with identical inputs.\nThe impact includes the systematic weakening of derived cryptographic keys, rendering encrypted data or derived secrets substantially more vulnerable to advanced cryptanalytic techniques and offline dictionary or brute-force attacks.\nAffected products are implementations utilizing openssl_encrypt before version 1.4.0.\nThe risk implication is a compromise of confidentiality and cryptographic integrity across dependent operational mechanisms.\nSuccessful exploitation requires an adversary to observe or induce identical input conditions to predict the resulting derived keys, capitalizing on the lack of salt entropy and the static nature of the info parameter to facilitate cross-target attacks.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper parameterization of the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) within the key normalization functions of openssl_encrypt versions prior to 1.4.0.\nHKDF is fundamentally designed to operate in two phases: an extraction phase that ingests input keying material (IKM) and an optional salt to produce a pseudorandom key (PRK), followed by an expansion phase that utilizes an info parameter to derive cryptographically strong output keying material.\nIn the vulnerable component, the implementation explicitly omits a dynamic or randomized salt, passing a null or zero-length salt value instead, while simultaneously enforcing a static, hardcoded info parameter.\nOmitting the salt removes the crucial domain separation and entropy enhancement that prevents precomputation attacks and guards against weak input keying material.\nFurthermore, utilizing a static info parameter across diverse operational contexts causes the expansion phase to yield deterministic and highly predictable key streams whenever identical input states are processed.\nThe attack flow proceeds as follows: an adversary identifies a target system utilizing openssl_encrypt prior to version 1.4.0 for key derivation and normalization processes.\nBy leveraging knowledge or control of the input parameters, the attacker can systematically predict the output of the key derivation function due to the lack of salt-induced entropy and the invariant info string.\nBecause the key derivation behaves deterministically across identical inputs, an attacker executing multi-target attacks can precompute or deduce derived keys for multiple distinct instances or sessions that share common input characteristics.\nThis strips away the intended cryptographic isolation between sessions or targets, allowing the attacker to bypass intended security boundaries.\nPost-exploitation impact involves the recovery or prediction of cryptographic keys, enabling unauthorized decryption of sensitive data, spoofing of authentication tokens, or complete compromise of downstream cryptographic mechanisms relying on the normalized keys.\nThe vulnerability affects openssl_encrypt versions before 1.4.0, requires no authentication or special privileges to target from an algorithmic standpoint, and manifests wherever the vulnerable key normalization functions are exposed to predictable or controllable inputs."
}