Bug #100999 InnoDB CBC Encryption padding not documented
Submitted: 29 Sep 2020 15:34 Modified: 13 Oct 2020 12:40
Reporter: Markus Heinrichs Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Documentation Severity:S3 (Non-critical)
Version: OS:Any
Assigned to: CPU Architecture:Any

[29 Sep 2020 15:34] Markus Heinrichs 
Description:
On page https://dev.mysql.com/doc/refman/8.0/en/innodb-data-encryption.html#innodb-data-encryption... the documentation states:
"InnoDB tablespace encryption uses Electronic Codebook (ECB) block encryption mode for tablespace key encryption and Cipher Block Chaining (CBC) block encryption mode for data encryption."
The documentation does not state which padding (ISO-Padding [ISO/IEC 7816-4], CMS-Padding [IETF-RFC 5652], ESP-Padding [IETF-RC 4303]) is used. As an alternative, Ciphertext Stealing (CBC-CS1, CBC-CS2, CBC-CS3 [NIST-SP 800-38A - Addendum]) would remove the vulnerability.

How to repeat:
Consult the documentation.

Suggested fix:
Please amend the documentation if Ciphertext Stealing or a padding is used together with CBC.
[29 Sep 2020 21:23] MySQL Verification Team 
Thank you for the bug report.
[13 Oct 2020 12:40] Daniel Price 
Posted by developer:
 
The referenced documentation has been updated as follows:

"Advanced Encryption Standard (AES) is the only supported encryption
algorithm. InnoDB tablespace encryption uses Electronic Codebook (ECB)
block encryption mode for tablespace key encryption and Cipher Block
Chaining (CBC) block encryption mode for data encryption. Padding is not
used with CBC block encryption mode. Instead, InnoDB ensures that the text
to be encrypted is a multiple of the block size."

The change should appear online soon.

Thank you for the bug report.