OpenSSL::Cipher#auth_tag=
static VALUE
ossl_cipher_set_auth_tag(VALUE self, VALUE vtag)
{
EVP_CIPHER_CTX *ctx;
unsigned char *tag;
int tag_len;
StringValue(vtag);
tag = (unsigned char *) RSTRING_PTR(vtag);
tag_len = RSTRING_LENINT(vtag);
GetCipher(self, ctx);
if (!(EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER))
ossl_raise(eCipherError, "authentication tag not supported by this cipher");
if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, tag_len, tag))
ossl_raise(eCipherError, "unable to set AEAD tag");
return vtag;
}
Sets the authentication tag to verify the integrity of the ciphertext.
The authentication tag must be set before final is called. The tag is verified during the final call.
Note that, for CCM mode and OCB mode, the expected length of the tag must be set before starting decryption by a separate call to auth_tag_len=. The content of the tag can be provided at any time before final is called.
NOTE: The caller must ensure that the String passed to this method has the desired length. Some cipher modes support variable tag lengths, and this method may accept a truncated tag without raising an exception.
See also the “AEAD Interface” section of the man page EVP_EncryptInit(3). This method internally calls EVP_CIPHER_CTX_ctrl() with EVP_CTRL_AEAD_SET_TAG.