Preview Ruby 4.1 is a preview. It can change before the final release. Switch to Ruby 4.0 →
OpenSSL::Cipher#final
static VALUE
ossl_cipher_final(VALUE self)
{
EVP_CIPHER_CTX *ctx;
int out_len;
VALUE str;
GetCipher(self, ctx);
str = rb_str_new(0, EVP_CIPHER_CTX_block_size(ctx));
if (!EVP_CipherFinal_ex(ctx, (unsigned char *)RSTRING_PTR(str), &out_len)) {
/* For AEAD ciphers, this is likely an authentication failure */
if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER) {
/* For AEAD ciphers, EVP_CipherFinal_ex failures are authentication tag verification failures */
ossl_raise(eAuthTagError, "AEAD authentication tag verification failed");
}
else {
/* For non-AEAD ciphers */
ossl_raise(eCipherError, "cipher final failed");
}
}
rb_str_set_len(str, out_len);
return str;
}
Returns the remaining data held in the cipher object. Further calls to Cipher#update or Cipher#final are invalid. This call should always be made as the last call of an encryption or decryption operation, after having fed the entire plaintext or ciphertext to the Cipher instance.
When encrypting using an AEAD cipher, the authentication tag can be retrieved by auth_tag after final has been called.
When decrypting using an AEAD cipher, this method will verify the integrity of the ciphertext and the associated data with the authentication tag, which must be set by auth_tag= prior to calling this method. If the verification fails, CipherError will be raised.