authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2023-03-22 07:17:52+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-03-22 06:17:52+00:00
log84b89d7cfe452f91fa22f2646ef53a3a7e990456
treef3ead35a68c20339cdaf42ec7753e5e85c001fad
parent87e07d8671b469431340c615dcdd5a5332d198ec
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

crypto.hmac: set the recommended key size to the block size (#15031)

HMAC supports arbitrary key sizes, and there are no practical reasons to use more than 256 bit keys. It still makes sense to match the security level, though, especially since a distinction between the block size and the key size can be confusing. Using HMAC.key_size instead of HMAC.mac_size caused our TLS implementation to compute wrong shared secrets when SHA-384 was used. So, fix it directly in `crypto.hmac` in order to prevent other misuses.

1 files changed, 1 insertions(+), 1 deletions(-)

lib/std/crypto/hmac.zig+1-1
...@@ -18,7 +18,7 @@ pub fn Hmac(comptime Hash: type) type {...@@ -18,7 +18,7 @@ pub fn Hmac(comptime Hash: type) type {
18 const Self = @This();18 const Self = @This();
19 pub const mac_length = Hash.digest_length;19 pub const mac_length = Hash.digest_length;
20 pub const key_length_min = 0;20 pub const key_length_min = 0;
21 pub const key_length = 32; // recommended key length21 pub const key_length = mac_length; // recommended key length
2222
23 o_key_pad: [Hash.block_length]u8,23 o_key_pad: [Hash.block_length]u8,
24 hash: Hash,24 hash: Hash,