From: Tom Yu Date: Sat, 19 Feb 2011 04:34:11 +0000 (+0000) Subject: pull up r24639, r24641 from trunk X-Git-Tag: krb5-1.9.1-beta1~8 X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=3884808c126d5081a3051040e162410d20b4c89d;hp=a46dda47298bd1aa48f5f05c7258d60a739441f1;p=krb5.git pull up r24639, r24641 from trunk ------------------------------------------------------------------------ r24641 | ghudson | 2011-02-18 07:06:57 -0800 (Fri, 18 Feb 2011) | 7 lines ticket: 6869 Fix a conceptual bug in r24639: the intermediate key container length should be the hash's output size, not its block size. (The bug did not show up in testing because it is harmless in practice; MD5 has a larger block size than output size.) ------------------------------------------------------------------------ r24639 | ghudson | 2011-02-16 14:52:41 -0800 (Wed, 16 Feb 2011) | 11 lines ticket: 6869 subject: hmac-md5 checksum doesn't work with DES keys target_version: 1.9 tags: pullup krb5int_hmacmd5_checksum calculates an intermediate key using an HMAC. The container for this key should be allocated using the HMAC output size (which is the hash blocksize), not the original key size. This bug was causing the function to fail with DES keys, which can be used with hmac-md5 in PAC signatures. ticket: 6869 target_version: 1.9.1 version_fixed: 1.9.1 status: resolved git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@24643 dc483132-0cff-0310-8789-dd5450dbe970 --- diff --git a/src/lib/crypto/krb/checksum/hmac_md5.c b/src/lib/crypto/krb/checksum/hmac_md5.c index 48129075d..784b746f5 100644 --- a/src/lib/crypto/krb/checksum/hmac_md5.c +++ b/src/lib/crypto/krb/checksum/hmac_md5.c @@ -52,7 +52,7 @@ krb5_error_code krb5int_hmacmd5_checksum(const struct krb5_cksumtypes *ctp, return KRB5_BAD_ENCTYPE; if (ctp->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR) { /* Compute HMAC(key, "signaturekey\0") to get the signing key ks. */ - ret = alloc_data(&ds, key->keyblock.length); + ret = alloc_data(&ds, ctp->hash->hashsize); if (ret != 0) goto cleanup;