Allow Microsoft HMAC-MD5 checksum types to use non-RC4 keys

In PAC signatures, the hmac-md5 checksum type can be used with AES
keys.  Make this work by removing the enc field from the hmac-md5 and
md5-hmac checksum types, and adding a check in
krb5int_hmacmd5_checksum() for a null key or a key which is longer
than the hash block size (64 bytes for MD5).  The checksum algorithm
only uses the key bits; it does invoke the cipher.

The checksum type names are kind of wrong, but we'll leave them alone
for compatibility.  The descriptions are updated.

ticket: 6751
target_version: 1.8.3
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24191 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/crypto/krb/checksum/hmac_md5.c b/src/lib/crypto/krb/checksum/hmac_md5.c
index 1dc05ea8b46e54b68fcb160dd4913273e5461076..48129075d0af21bbcbe10aa6e6de543febeade79 100644 (file)
--- a/src/lib/crypto/krb/checksum/hmac_md5.c
+++ b/src/lib/crypto/krb/checksum/hmac_md5.c
@@ -48,6 +48,8 @@ krb5_error_code krb5int_hmacmd5_checksum(const struct krb5_cksumtypes *ctp,
     krb5_data ds = empty_data(), hashval = empty_data();
     char t[4];
 
+    if (key == NULL || key->keyblock.length > ctp->hash->blocksize)
+        return KRB5_BAD_ENCTYPE;
     if (ctp->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR) {
        /* Compute HMAC(key, "signaturekey\0") to get the signing key ks. */
        ret = alloc_data(&ds, key->keyblock.length);

diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c
index 74fd158abe83a8db78fa2181da3d7986c9e4ab15..6e16b4ea89e803f06d5acc912e1d5dd291a5c01a 100644 (file)
--- a/src/lib/crypto/krb/cksumtypes.c
+++ b/src/lib/crypto/krb/cksumtypes.c
@@ -82,8 +82,8 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = {
 
     { CKSUMTYPE_HMAC_MD5_ARCFOUR,
       "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" },
-      "Microsoft HMAC MD5 (RC4 key)",
-      &krb5int_enc_arcfour, &krb5int_hash_md5,
+      "Microsoft HMAC MD5",
+      NULL, &krb5int_hash_md5,
       krb5int_hmacmd5_checksum, NULL,
       16, 16, 0 },
 
@@ -100,8 +100,8 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = {
       20, 12, 0 },
 
     { CKSUMTYPE_MD5_HMAC_ARCFOUR,
-      "md5-hmac-rc4", { 0 }, "Microsoft MD5 HMAC (RC4 key)",
-      &krb5int_enc_arcfour, &krb5int_hash_md5,
+      "md5-hmac-rc4", { 0 }, "Microsoft MD5 HMAC",
+      NULL, &krb5int_hash_md5,
       krb5int_hmacmd5_checksum, NULL,
       16, 16, 0 },
 };