mirror of
https://github.com/yuzu-emu/mbedtls.git
synced 2024-11-26 13:35:42 +01:00
81c7b18351
The truncated HMAC extension as described in https://tools.ietf.org/html/rfc6066.html#section-7 specifies that when truncated HMAC is used, only the HMAC output should be truncated, while the HMAC key generation stays unmodified. This commit fixes Mbed TLS's behavior of also truncating the key, potentially leading to compatibility issues with peers running other stacks than Mbed TLS. Details: The keys for the MAC are pieces of the keyblock that's generated from the master secret in `mbedtls_ssl_derive_keys` through the PRF, their size being specified as the size of the digest used for the MAC, regardless of whether truncated HMAC is enabled or not. /----- MD size ------\ /------- MD size ----\ Keyblock +----------------------+----------------------+------------------+--- now | MAC enc key | MAC dec key | Enc key | ... (correct) +----------------------+----------------------+------------------+--- In the previous code, when truncated HMAC was enabled, the HMAC keys were truncated to 10 bytes: /-10 bytes-\ /-10 bytes-\ Keyblock +-------------+-------------+------------------+--- previously | MAC enc key | MAC dec key | Enc key | ... (wrong) +-------------+-------------+------------------+--- The reason for this was that a single variable `transform->maclen` was used for both the keysize and the size of the final MAC, and its value was reduced from the MD size to 10 bytes in case truncated HMAC was negotiated. This commit fixes this by introducing a temporary variable `mac_key_len` which permanently holds the MD size irrespective of the presence of truncated HMAC, and using this temporary to obtain the MAC key chunks from the keyblock. |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| aes.c | ||
| aesni.c | ||
| arc4.c | ||
| asn1parse.c | ||
| asn1write.c | ||
| base64.c | ||
| bignum.c | ||
| blowfish.c | ||
| camellia.c | ||
| ccm.c | ||
| certs.c | ||
| cipher_wrap.c | ||
| cipher.c | ||
| cmac.c | ||
| CMakeLists.txt | ||
| ctr_drbg.c | ||
| debug.c | ||
| des.c | ||
| dhm.c | ||
| ecdh.c | ||
| ecdsa.c | ||
| ecjpake.c | ||
| ecp_curves.c | ||
| ecp.c | ||
| entropy_poll.c | ||
| entropy.c | ||
| error.c | ||
| gcm.c | ||
| havege.c | ||
| hmac_drbg.c | ||
| Makefile | ||
| md2.c | ||
| md4.c | ||
| md5.c | ||
| md_wrap.c | ||
| md.c | ||
| memory_buffer_alloc.c | ||
| net_sockets.c | ||
| oid.c | ||
| padlock.c | ||
| pem.c | ||
| pk_wrap.c | ||
| pk.c | ||
| pkcs5.c | ||
| pkcs11.c | ||
| pkcs12.c | ||
| pkparse.c | ||
| pkwrite.c | ||
| platform.c | ||
| ripemd160.c | ||
| rsa.c | ||
| sha1.c | ||
| sha256.c | ||
| sha512.c | ||
| ssl_cache.c | ||
| ssl_ciphersuites.c | ||
| ssl_cli.c | ||
| ssl_cookie.c | ||
| ssl_srv.c | ||
| ssl_ticket.c | ||
| ssl_tls.c | ||
| threading.c | ||
| timing.c | ||
| version_features.c | ||
| version.c | ||
| x509_create.c | ||
| x509_crl.c | ||
| x509_crt.c | ||
| x509_csr.c | ||
| x509.c | ||
| x509write_crt.c | ||
| x509write_csr.c | ||
| xtea.c | ||