Skip to content

Fix incorrect aes_gcm constants used in xaes-256-gcm#836

Merged
tarcieri merged 2 commits into
RustCrypto:masterfrom
eligrubb:use-aes-gcm-max-constants
Jun 18, 2026
Merged

Fix incorrect aes_gcm constants used in xaes-256-gcm#836
tarcieri merged 2 commits into
RustCrypto:masterfrom
eligrubb:use-aes-gcm-max-constants

Conversation

@eligrubb

@eligrubb eligrubb commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Fixes #837.

Currently the max length constants for plaintext (P_MAX), associated data (A_MAX), and ciphertext (C_MAX) are not correct for XAES-256-GCM.

Current Correct
P_MAX 1 << 36 (1 << 36) - 32
A_MAX 1 << 36 (1 << 61) - 1
C_MAX (1 << 36) + 16 (1 << 36) - 32

This PR resolves this by using the aes_gcm crates constants instead of redefining them in this crate. Relying on the definition in aes_gcm makes sense because the underlying call to aes_gcm dictates the maximums for plaintext, aad, and ciphertext.

Additionally, the code previously included the 16-byte tag in the C_MAX length. However, the AeadInOut trait explicitly operates in a detached state where the tag is handled separately from the ciphertext, meaning the ciphertext is always the same length as the plaintext. So the current C_MAX check in decrypt_inout_detached() can be replaced with a P_MAX check (alternatively, C_MAX could be defined as equivalent to P_MAX).

All tests run and pass.

Comment thread xaes-256-gcm/src/lib.rs
@tarcieri tarcieri merged commit 4b08ebe into RustCrypto:master Jun 18, 2026
13 checks passed
@eligrubb eligrubb deleted the use-aes-gcm-max-constants branch June 18, 2026 17:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

xaes-256-gcm uses incorrect maximum constants

2 participants