Re: Feature Request: Add AES-128-CFB Mode Support to pgcrypto

On 2025-Jan-29, Umar Hayat wrote:

> Hi Daniel Gustafsson and Vladyslav Nebozhyn,
> I created a patch for CFB mode for AES encryption. Please have a look
> and let me know what you think.
> Patch covers implementation, tests and documentation changes.
>
> OpenSSL profives aes-cfb1, aes-cfb8 and aes-cfb128 modes where aes-cfb
> defaults to aes-cfb128. For simplicity I only added aes-cfb, which is
> the most common method used, lower number of bits will introduce
> performance degradation, but if it's desirable I can add them as well.

I kicked the tires on this by encrypting a file with
openssl aes-128-cfb -K afe908123efcba901230afe908eb5a04 -iv 912387caedade123912387c7ec0b9d0f -pbkdf2
then importing that into a bytea column. Then I can sort-of obtain the
file back with

select decrypt_iv from data, decrypt_iv(a, '\xafe908123efcba901230', '\x912387caedade123', 'aes-cfb');

... Except that appears that openssl will encode UTF8 characters in my file
as \ooo octal escapes in the encrypted output, which is really weird, so
the file doesn't roundtrip exactly. Maybe this is a pgcrypto shortcoming, not
sure. The final output looks like this (shortened):

=# select decrypt_iv from data, decrypt_iv(a, '\xafe908123efcba901230afe908eb5a04', '\x912387caedade123912387c7ec0b9d0f', 'aes-cfb');
>
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────>
\302\241Hoy ha sido un d\303\255a genial! Era el cumple de la abuela, que es la mam\303\241 de mam\303\241,

Anyway, at least the bytes appear to be interpreted the same by both
openssl and this new function, so that's good news.

--
Álvaro Herrera PostgreSQL Developer — https://www.EnterpriseDB.com/
"Having your biases confirmed independently is how scientific progress is
made, and hence made our great society what it is today" (Mary Gardiner)