Skip to content
  • Eric Biggers's avatar
    crypto: hmac - require that the underlying hash algorithm is unkeyed · af3ff804
    Eric Biggers authored
    Because the HMAC template didn't check that its underlying hash
    algorithm is unkeyed, trying to use "hmac(hmac(sha3-512-generic))"
    through AF_ALG or through KEYCTL_DH_COMPUTE resulted in the inner HMAC
    being used without having been keyed, resulting in sha3_update() being
    called without sha3_init(), causing a stack buffer overflow.
    
    This is a very old bug, but it seems to have only started causing real
    problems when SHA-3 support was added (requires CONFIG_CRYPTO_SHA3)
    because the innermost hash's state is ->import()ed from a zeroed buffer,
    and it just so happens that other hash algorithms are fine with that,
    but SHA-3 is not.  However, there could be arch or hardware-dependent
    hash algorithms also affected; I couldn't test everything.
    
    Fix the bug by introducing a function crypto_shash_alg_has_setkey()
    which tests whether a shash algorithm is keyed.  Then update the HMAC
    template to require that its underlying hash algorithm is unkeyed....
    af3ff804