|
 |
7682e8 |
From 58c92098d053aae7c78cc42bdd7c80c13efc89bb Mon Sep 17 00:00:00 2001
|
|
|
7682e8 |
From: NIIBE Yutaka <gniibe@fsij.org>
|
|
|
7682e8 |
Date: Fri, 24 Jun 2022 08:59:31 +0900
|
|
|
7682e8 |
Subject: [PATCH] hmac,hkdf: Allow use of shorter salt for HKDF.
|
|
|
7682e8 |
|
|
|
7682e8 |
* cipher/md.c (prepare_macpads): Move the check to...
|
|
|
7682e8 |
* src/visibility.c (gcry_mac_setkey): ... here.
|
|
|
7682e8 |
* tests/t-kdf.c (check_hkdf): No failure is expected.
|
|
|
7682e8 |
|
|
|
7682e8 |
--
|
|
|
7682e8 |
|
|
|
7682e8 |
GnuPG-bug-id: 6039
|
|
|
7682e8 |
Fixes-commit: 76aad97dd312e83f2f9b8d086553f2b72ab6546f
|
|
|
7682e8 |
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
|
|
|
7682e8 |
---
|
|
|
7682e8 |
cipher/md.c | 3 ---
|
|
|
7682e8 |
src/visibility.c | 3 +++
|
|
|
7682e8 |
tests/t-kdf.c | 12 +-----------
|
|
|
7682e8 |
3 files changed, 4 insertions(+), 14 deletions(-)
|
|
|
7682e8 |
|
|
|
7682e8 |
diff --git a/cipher/md.c b/cipher/md.c
|
|
|
7682e8 |
index 4f4fc9bf..34336b5c 100644
|
|
|
7682e8 |
--- a/cipher/md.c
|
|
|
7682e8 |
+++ b/cipher/md.c
|
|
|
7682e8 |
@@ -903,9 +903,6 @@ prepare_macpads (gcry_md_hd_t a, const unsigned char *key, size_t keylen)
|
|
|
7682e8 |
{
|
|
|
7682e8 |
GcryDigestEntry *r;
|
|
|
7682e8 |
|
|
|
7682e8 |
- if (fips_mode () && keylen < 14)
|
|
|
7682e8 |
- return GPG_ERR_INV_VALUE;
|
|
|
7682e8 |
-
|
|
|
7682e8 |
if (!a->ctx->list)
|
|
|
7682e8 |
return GPG_ERR_DIGEST_ALGO; /* Might happen if no algo is enabled. */
|
|
|
7682e8 |
|
|
|
7682e8 |
diff --git a/src/visibility.c b/src/visibility.c
|
|
|
7682e8 |
index c98247d8..aee5bffb 100644
|
|
|
7682e8 |
--- a/src/visibility.c
|
|
|
7682e8 |
+++ b/src/visibility.c
|
|
|
7682e8 |
@@ -946,6 +946,9 @@ gcry_mac_setkey (gcry_mac_hd_t hd, const void *key, size_t keylen)
|
|
|
7682e8 |
if (!fips_is_operational ())
|
|
|
7682e8 |
return gpg_error (fips_not_operational ());
|
|
|
7682e8 |
|
|
|
7682e8 |
+ if (fips_mode () && keylen < 14)
|
|
|
7682e8 |
+ return GPG_ERR_INV_VALUE;
|
|
|
7682e8 |
+
|
|
|
7682e8 |
return gpg_error (_gcry_mac_setkey (hd, key, keylen));
|
|
|
7682e8 |
}
|
|
|
7682e8 |
|
|
|
7682e8 |
--
|
|
|
7682e8 |
2.37.1
|
|
|
7dd5c5 |
commit 02718ade6ab5eee38169c2102097166770a2456d
|
|
|
7dd5c5 |
Author: Jakub Jelen <jjelen@redhat.com>
|
|
|
7dd5c5 |
Date: Thu Oct 20 16:33:11 2022 +0200
|
|
|
7682e8 |
|
|
|
7dd5c5 |
visiblity: Check the HMAC key length in FIPS mode
|
|
|
7dd5c5 |
|
|
|
7dd5c5 |
---
|
|
|
7dd5c5 |
* src/visibility.c (gcry_md_setkey): Check the HMAC key length in FIPS
|
|
|
7dd5c5 |
mode also in the md_ API.
|
|
|
7dd5c5 |
|
|
|
7dd5c5 |
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
|
7dd5c5 |
|
|
|
7dd5c5 |
diff --git a/src/visibility.c b/src/visibility.c
|
|
|
7dd5c5 |
index 150b197d..73db3dea 100644
|
|
|
7dd5c5 |
--- a/src/visibility.c
|
|
|
7dd5c5 |
+++ b/src/visibility.c
|
|
|
7dd5c5 |
@@ -1357,6 +1357,10 @@ gcry_md_setkey (gcry_md_hd_t hd, const void *key, size_t keylen)
|
|
|
7dd5c5 |
{
|
|
|
7dd5c5 |
if (!fips_is_operational ())
|
|
|
7dd5c5 |
return gpg_error (fips_not_operational ());
|
|
|
7dd5c5 |
+
|
|
|
7dd5c5 |
+ if (fips_mode () && keylen < 14)
|
|
|
7dd5c5 |
+ return GPG_ERR_INV_VALUE;
|
|
|
7dd5c5 |
+
|
|
|
7dd5c5 |
return gpg_error (_gcry_md_setkey (hd, key, keylen));
|
|
|
7dd5c5 |
}
|
|
|
7dd5c5 |
|