Fix Blake2 oversized key path#10447
Conversation
- Reduce long keys in a separate state rather than reusing the state used for the HMAC inner hash. - Pad the rest of the buffer with zeros as required by the spec. - Add regression tests
There was a problem hiding this comment.
Pull request overview
This PR fixes HMAC-BLAKE2b/HMAC-BLAKE2s handling for oversized keys by ensuring the “hash-long-key then pad to blocksize” step doesn’t clobber the active inner-hash state, and by guaranteeing the padded key buffer is zero-filled per the HMAC spec behavior. It also adds regression tests to prevent reintroduction.
Changes:
- Zero-initialize the block-sized key buffer (
x_key) so reduced keys (hashed long keys) are correctly zero-padded to block size. - In
wc_Blake2*b/s*HmacFinal, hash oversized keys using a dedicated temporaryBlake2*state (keyHash) instead of reusing the caller’sb2*state. - Add test vectors covering oversized key inputs for both BLAKE2b and BLAKE2s HMAC.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| wolfcrypt/test/test.c | Adds regression tests for HMAC-BLAKE2b/HMAC-BLAKE2s with oversized keys. |
| wolfcrypt/src/blake2s.c | Fixes oversized-key handling by zero-padding x_key and using a separate hash state in wc_Blake2sHmacFinal. |
| wolfcrypt/src/blake2b.c | Fixes oversized-key handling by zero-padding x_key and using a separate hash state in wc_Blake2bHmacFinal. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
Jenkins retest this please |
2 similar comments
|
Jenkins retest this please |
|
Jenkins retest this please |
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #10447
Scan targets checked: wolfcrypt-bugs, wolfcrypt-src
No new issues found in the changed files. ✅
Description
Fixes zd#21783 (1, 3)
Testing