denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Use a longer key to test/initialize HMAC instances

Browse Source 
OpenSSL enforces a minimum of 14 bytes (112 bits) on the key size when
used in FIPS-mode (as required by SP 800-131A).  So by using an empty
string, instantiation always failed.  32 bytes (256 bits) should be safe
for now.

Closes strongswan/strongswan#557
This commit is contained in:
Tobias Brunner
2021-08-19 14:06:19 +02:00
parent e6a904de69
commit 64b281723c
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/openssl/openssl_hmac.c
+4 -3
View File
@@ -100,8 +100,9 @@ METHOD(mac_t, set_key, bool,
private_mac_t *this, chunk_t key) private_mac_t *this, chunk_t key)
{ {
if (!key.ptr) if (!key.ptr)
{ /* HMAC_Init_ex() won't reset the key if a NULL pointer is passed */ { /* HMAC_Init_ex() won't reset the key if a NULL pointer is passed,
key = chunk_from_str(""); * use a lenghty string in case there is a limit in FIPS-mode */
key = chunk_from_str("00000000000000000000000000000000");
} }
return reset(this, key); return reset(this, key);
} }
@@ -188,7 +189,7 @@ static mac_t *hmac_create(hash_algorithm_t algo)
#endif #endif
/* make sure the underlying hash algorithm is supported */ /* make sure the underlying hash algorithm is supported */
if (!set_key(this, chunk_from_str(""))) if (!set_key(this, chunk_empty))
{ {
destroy(this); destroy(this);
return NULL; return NULL;