denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wolfssl: Set a dummy key when testing KDF implementations

Browse Source 
In FIPS mode, wolfSSL enforces a minimum key size for these algorithms.
This commit is contained in:
Tobias Brunner
2025-06-02 09:15:05 +02:00
parent 757e00c0ae
commit 879e3ce05a
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/wolfssl/wolfssl_kdf.c
+4 -1
View File
@@ -156,6 +156,7 @@ kdf_t *wolfssl_kdf_create(key_derivation_function_t algo, va_list args)
pseudo_random_function_t prf_alg; pseudo_random_function_t prf_alg;
enum wc_HashType hash; enum wc_HashType hash;
char buf[HASH_SIZE_SHA512]; char buf[HASH_SIZE_SHA512];
chunk_t dummy_key = chunk_create(buf, sizeof(buf));
if (algo != KDF_PRF && algo != KDF_PRF_PLUS) if (algo != KDF_PRF && algo != KDF_PRF_PLUS)
{ {
@@ -179,9 +180,11 @@ kdf_t *wolfssl_kdf_create(key_derivation_function_t algo, va_list args)
}, },
.type = algo, .type = algo,
.hash = hash, .hash = hash,
.key = chunk_clone(dummy_key),
); );
/* test if we can actually use the algorithm */ /* test if we can actually use the algorithm (using a long dummy key in
* case FIPS mode is used) */
if (!get_bytes(this, algo == KDF_PRF ? get_length(this) : sizeof(buf), buf)) if (!get_bytes(this, algo == KDF_PRF ? get_length(this) : sizeof(buf), buf))
{ {
destroy(this); destroy(this);