Update crypto.md to correct description of decipher.setAuthTag#33097
Update crypto.md to correct description of decipher.setAuthTag#33097jbuhacoff wants to merge 4 commits intonodejs:masterfrom
decipher.setAuthTag#33097Conversation
Calling `decipher.setAuthTag` after `decipher.update` will result in an error like `Unsupported state or unable to authenticate data`. The example code in [CCM mode](https://nodejs.org/docs/latest-v14.x/api/crypto.html#crypto_ccm_mode) is correct, but to demonstrate the mistake in the documentation you can take the same example and move the `setAuthTag` call to in between `update` and `final` you will see the error.
nodejs-github-bot
added
crypto
|
That's not quite correct since only CCM mode needs to have |
|
Right, that should be documented. I suggested changing it to mention |
|
I think adding a note about the differences between the modes with regard to calling |
Restore note about calling setAuthTag before decipher.final and add new note about calling it before decipher.update for CCM mode.
|
Updated the pull request to address comments by @mscdex, please check it. |
doc/api/crypto.md
Outdated
There was a problem hiding this comment.
I would just modify this sentence instead to clarify, something like:
The `decipher.setAuthTag()` method must be called before
[`decipher.update()`][] for `CCM` mode or before [`decipher.final()`][] for
`GCM` and `OCB` modes. `decipher.setAuthTag()` can only be called once.
There was a problem hiding this comment.
Great, thanks! I just pushed a correction with this advice.
Added detail to note about calling setAuthTag before decipher.final to mention that for CCM mode it must be called before decipher.update.
Added detail to descripption of `decipher.setAuthTag()` method that it must be called before `decipher.update()` for `CCM` mode.
|
/cc @nodejs/crypto to make sure this is the intended behavior |
bnoordhuis
left a comment
bnoordhuis
left a comment
There was a problem hiding this comment.
Thanks, that's correct. GCM and OCB are online AEADs, CCM is not.
|
Landed in d135b50, thanks for the PR! 🎉 |
6 participants
Calling
decipher.setAuthTagafterdecipher.updatewill result in an error likeUnsupported state or unable to authenticate data. The example code in CCM mode is correct, but to demonstrate the mistake in the documentation you can take the same example and move thesetAuthTagcall to in betweenupdateandfinalyou will see the error.Checklist
make -j4 test(UNIX), orvcbuild test(Windows) passes