mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
4a4253682a
wc_HmacInit_Id and wc_HmacInit_Label name a key held by a crypto callback device, and the caller keys the Hmac with wc_HmacSetKey(NULL, 0). Two things lost that key. Keying the Hmac again, for a new MAC or another hash, frees it first, and wc_HmacFree zeroes the whole struct. Only devId was put back, so the id and label were gone and the device got a key with no name and no bytes. Restore the id and label as well, as devId is. When the device declined an update or final, the software path ran with the empty key from wc_HmacSetKey(NULL, 0) and returned a MAC under it. Return MISSING_KEY instead when the Hmac is named by id or label and has no key bytes, as AES does for a key held on a device. An Hmac named by id that was given key bytes still uses them. A build with PK callbacks but no crypto callbacks also has wc_HmacInit_Id, but no device to hold the key and no keyRaw to tell, so the check is left out there. The check uses keyRaw, which is NULL only after wc_HmacSetKey(NULL, 0). keyLen keeps only the low 16 bits of the length, so it reads 0 for a key of 64 KiB. PKCS#11 declined every such key on a token that reports a minimum HMAC key size, because it checked hmac->keyLen, which is 0 when the key is on the token. Check the length only for a key passed in from software; C_SignInit checks the token key. test_wc_HmacId_CryptoCb keys an Hmac from wc_HmacInit_Id twice and checks that the device still sees the id, then that a declined update and final return MISSING_KEY. It also checks that a label survives a second wc_HmacSetKey. test_wc_HmacId_NoDevice checks that an Hmac named by id MACs with key bytes it is given, in builds with or without crypto callbacks, also with a 64 KiB key, and that one without key bytes gets MISSING_KEY when no device takes it.
The wolfSSL manual is available at: http://www.wolfssl.com/documentation/wolfSSL-Manual.pdf The wolfSSL API guide is available at: https://www.wolfssl.com/doxygen/wolfssl_API.html The wolfCrypt API guide is available at: https://www.wolfssl.com/doxygen/wolfcrypt_API.html