Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix HKDF-Extract with empty salt #45 #46

Merged
merged 2 commits into from
Dec 8, 2020

Conversation

LuoZijun
Copy link
Contributor

@LuoZijun LuoZijun commented Dec 8, 2020

Fix #45 .

Copy link
Member

@newpavlov newpavlov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you! I have improved your fix with a slightly more elegant solution.

Could you also please add a test vector for an empty salt from the RFC, so we will not get a regression in future? If you don't have time right now, no worries, I can add it in a separate PR a bit alter.

@tarcieri
Maybe it's worth to add a RUSTSEC advisory for this bug?

@LuoZijun
Copy link
Contributor Author

LuoZijun commented Dec 8, 2020

@newpavlov

i think do not need add a RUSTSEC advisory for this "bug".

Because this "bug" will only appear when OutputLen > BlockLen. but all crypto hasher OutputLen always < BlockLen :)

See code:

https://github.com/RustCrypto/MACs/blob/4ab9f441fb08c754c22d65963fa948693c6e5116/hmac/src/lib.rs#L145-L150

@newpavlov
Copy link
Member

Because this "bug" will only appear when OutputLen > BlockLen.

Ah, yes. You are correct. :)

@newpavlov newpavlov merged commit 77c221d into RustCrypto:master Dec 8, 2020
@tarcieri tarcieri mentioned this pull request Apr 29, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

HKDF-Extract with empty salt
3 participants