)]}'
{
  "commit": "e49e1db1c275b202a6734967ddb783aad3ce949b",
  "tree": "66fe09a21cb8a8fbe663eb7755f88a363ae85cbf",
  "parents": [
    "474abc95d902d5dbabf87fab94a9246a770d35ce"
  ],
  "author": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Tue Sep 01 12:57:16 2026 +0100"
  },
  "committer": {
    "name": "Michael Brown",
    "email": "mcb30@ipxe.org",
    "time": "Tue Sep 01 14:24:42 2026 +0100"
  },
  "message": "[crypto] Reject zero-length IVs for GCM ciphers\n\nA zero-length IV is not permitted by the NIST GCM specification, since\nit would lead to leaking the authentication key.\n\nThe only existing code path that can currently lead to the use of a\nGCM cipher with a zero-length initialisation vector is CMS decryption.\nModifying a CMS encrypted message to include a zero-length IV would\nleak information required to obtain the authentication key into the\ntransient decrypted image, but this transient image would then fail\nthe GCM authentication tag check and so the decrypted plaintext would\nbe immediately overwritten (with the re-encrypted ciphertext).\n\nImprove robustness by rejecting a zero-length initialisation vector\nfor a GCM cipher, and add a test case to ensure that this rejection\nremains in place in future.\n\nSigned-off-by: Michael Brown \u003cmcb30@ipxe.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "3948e0a071821fd70375803cbff97f1f0c655aec",
      "old_mode": 33188,
      "old_path": "src/crypto/gcm.c",
      "new_id": "f569be0ad62c94887501706ba63e5d65fb92e86e",
      "new_mode": 33188,
      "new_path": "src/crypto/gcm.c"
    },
    {
      "type": "modify",
      "old_id": "0e908d957e8cbcbec809a1c18b4ae6ad5b552454",
      "old_mode": 33188,
      "old_path": "src/include/ipxe/errfile.h",
      "new_id": "31175d33c92b4639eb969f32350f36967feeb17d",
      "new_mode": 33188,
      "new_path": "src/include/ipxe/errfile.h"
    },
    {
      "type": "modify",
      "old_id": "04a42b5c9dbe9878d9e7bff17e1984976fee023d",
      "old_mode": 33188,
      "old_path": "src/tests/gcm_test.c",
      "new_id": "2246a28f546577f13fe22d571844681b8c1dbe06",
      "new_mode": 33188,
      "new_path": "src/tests/gcm_test.c"
    }
  ]
}