Fix incorrect aes_gcm constants used in xaes-256-gcm#836
Merged
Conversation
tarcieri
reviewed
Jun 18, 2026
tarcieri
approved these changes
Jun 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #837.
Currently the max length constants for plaintext (
P_MAX), associated data (A_MAX), and ciphertext (C_MAX) are not correct forXAES-256-GCM.P_MAX1 << 36(1 << 36) - 32A_MAX1 << 36(1 << 61) - 1C_MAX(1 << 36) + 16(1 << 36) - 32This PR resolves this by using the
aes_gcmcrates constants instead of redefining them in this crate. Relying on the definition inaes_gcmmakes sense because the underlying call toaes_gcmdictates the maximums for plaintext, aad, and ciphertext.Additionally, the code previously included the 16-byte tag in the
C_MAXlength. However, theAeadInOuttrait explicitly operates in a detached state where the tag is handled separately from the ciphertext, meaning the ciphertext is always the same length as the plaintext. So the currentC_MAXcheck indecrypt_inout_detached()can be replaced with aP_MAXcheck (alternatively,C_MAXcould be defined as equivalent toP_MAX).All tests run and pass.