fix(blake2): reject empty MAC keys - #914
Open
thevilledev wants to merge 2 commits into
Open
Conversation
Cover the generic KeyInit constructor alongside the parameterized constructor so both BLAKE2 variants enforce the same key invariant. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
Treat zero-length keys as invalid through the generic KeyInit API. Match the parameterized constructor and keep unkeyed hashing explicit. Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RFC 7693 §2.5 reserves
kk = 0for unkeyed hashing, and §3.3 prepends a padded key block only whenkk > 0.new_from_slice(&[])did both at once by recordingkk = 0in the parameter block while still seeding the buffer with a full zero-filled key block.new_with_salt_and_personalhas rejected this since #510.new_from_slicenever got the same guard, and #510's regression test covered only the constructor it fixed. The changelog entry for v0.11.0 lists the handling of unkeyed hashes in keyed mode as fixed (#911).This issue was found by differential testing against various other libraries like digestif, HACL* and Cryptokit, which all return the plain unkeyed digest for a zero-length key.
Prior work on empty keys:
new_with_salt_and_personal.Noneas the explicit unkeyed form.Changes
KeyInit::new_from_slice, matching the implementation in blake2: Refuse empty keys in keyed hash construction #510mac_refuses_empty_keystest to coverKeyInit::new_from_slicefor both BLAKE2b and BLAKE2s.Test
The regression test fails before the implementation change and passes afterward.