root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

hmac: stop using secure memory for the HMAC key 

Secure memory is design for long term storage of private material.
HMAC keys are not this.

Secure memory use was introduced in July 2020 by commit
3fddbb264e.

Fixes #28346

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28412)
This commit is contained in:
Pauli 2025-09-02 08:48:06 +10:00
parent 2e0e517aea
commit 8e3c76085f
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
providers/implementations/macs/hmac_prov.c
View File

@ -85,7 +85,7 @@ static void hmac_free(void *vmacctx)
if (macctx != NULL) {
HMAC_CTX_free(macctx->ctx);
ossl_prov_digest_reset(&macctx->digest);
OPENSSL_secure_clear_free(macctx->key, macctx->keylen);
OPENSSL_clear_free(macctx->key, macctx->keylen);
OPENSSL_free(macctx);
}
}
@ -114,13 +114,13 @@ static void *hmac_dup(void *vsrc)
return NULL;
}
if (src->key != NULL) {
/* There is no "secure" OPENSSL_memdup */
dst->key = OPENSSL_secure_malloc(src->keylen > 0 ? src->keylen : 1);
dst->key = OPENSSL_malloc(src->keylen > 0 ? src->keylen : 1);
if (dst->key == NULL) {
hmac_free(dst);
return 0;
}
memcpy(dst->key, src->key, src->keylen);
if (src->keylen > 0)
memcpy(dst->key, src->key, src->keylen);
}
return dst;
}
@ -145,12 +145,14 @@ static int hmac_setkey(struct hmac_data_st *macctx,
const EVP_MD *digest;
if (macctx->key != NULL)
OPENSSL_secure_clear_free(macctx->key, macctx->keylen);
OPENSSL_clear_free(macctx->key, macctx->keylen);
/* Keep a copy of the key in case we need it for TLS HMAC */
macctx->key = OPENSSL_secure_malloc(keylen > 0 ? keylen : 1);
macctx->key = OPENSSL_malloc(keylen > 0 ? keylen : 1);
if (macctx->key == NULL)
return 0;
memcpy(macctx->key, key, keylen);
if (keylen > 0)
memcpy(macctx->key, key, keylen);
macctx->keylen = keylen;
digest = ossl_prov_digest_md(&macctx->digest);