Search code examples
c++cencryptionopensslaes

Alternative for deprecated AES_ige_encrypt() API in openssl


While upgrading from OpenSSL version 1.0.0 to 1.1.1x there was a warning that the API AES_ige_encrypt() is deprecated which is used for the encryption and decryption using AES_ige. Even though the source comments says the function is deprecated it not mentioning anything about any alternatives for this API. Searching the net didn't gave any useful information regarding this. It will be very helpful if anyone can suggest the OpenSSL API that will provide the same functionality as AES_ige_encrypt() API.


Solution

  • Are you sure you are using the correct version of OpenSSL? That function is deprecated in the master branch (i.e. what will become OpenSSL 3.0), but is not yet deprecated in 1.1.1.

    Anyway, you should not be using these modes. As per the CHANGES entry:

    *) The functions AES_ige_encrypt() and AES_bi_ige_encrypt() have been deprecated. These undocumented functions were never integrated into the EVP layer and implement the AES Infinite Garble Extension (IGE) mode and AES Bi-directional IGE mode. These modes were never formally standardised and usage of these functions is believed to be very small. In particular AES_bi_ige_encrypt() has a known bug. It accepts 2 AES keys, but only one is ever used. The security implications are believed to be minimal, but this issue was never fixed for backwards compatibility reasons. New code should not use these modes. [Matt Caswell]

    As per my comment on the end - new code should not use these modes. If you are using them, then the alternative is to look for an alternative mode that meets your requirement and use the EVP functions to use that mode.