allow HMAC via EVP_PKEY raw privkey functions #1338
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #1338 +/- ##
==========================================
- Coverage 76.84% 76.84% -0.01%
==========================================
Files 425 425
Lines 71502 71532 +30
==========================================
+ Hits 54948 54970 +22
- Misses 16554 16562 +8 ☔ View full report in Codecov by Sentry. |
samuel40791765
force-pushed
the
evp-pkey-hmac-asn1
branch
from
087bb11 to
71111aa
Compare
samuel40791765
force-pushed
the
evp-pkey-hmac-asn1
branch
from
71111aa to
45c743d
Compare
|
|
||
| // The semantics of the EVP APIs are to return the length, if |priv| is NULL. | ||
| if (priv == NULL) { | ||
| *len = key->key_len; |
There was a problem hiding this comment.
should we do a null check on len here, or can we always assume that to be a valid pointer?
There was a problem hiding this comment.
Added a check above
| EXPECT_TRUE(EVP_PKEY_get_raw_private_key(raw_pkey.get(), retrieved_key.data(), | ||
| &retrieved_key_len)); | ||
| retrieved_key.resize(retrieved_key_len); | ||
| EXPECT_EQ(Bytes(retrieved_key), Bytes(key)); |
There was a problem hiding this comment.
considering branch coverage... should we add a case where we resize the buffer andretrieved_key_len to something smaller than the key size and and expect failure?
There was a problem hiding this comment.
Sure I added one more here. There are cases where the key could be NULL, so I've filtered those out here.
samuel40791765
force-pushed
the
evp-pkey-hmac-asn1
branch
from
45c743d to
f5b7f34
Compare
samuel40791765
force-pushed
the
evp-pkey-hmac-asn1
branch
from
e5ce5e6 to
24ceacc
Compare
WillChilds-Klein
approved these changes
Jan 18, 2024
torben-hansen
approved these changes
Jan 18, 2024
samuel40791765
force-pushed
the
evp-pkey-hmac-asn1
branch
from
c8efdff to
424ce04
Compare
dougch
pushed a commit
to dougch/aws-lc
that referenced
this pull request
Jan 30, 2024
This adds support for consuming `EVP_PKEY_HMAC` through `EVP_PKEY_new_raw_private_key` and `EVP_PKEY_get_raw_private_key`. Logic for `set_priv_raw` and `get_priv_raw` are required for `EVP_PKEY_HMAC`'s ASN1 methods to get things working. New tests setting the key and retrieving it for `EVP_PKEY_HMAC` were also added.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issues:
Resolves
CryptoAlg-1704Description of changes:
Follow up from #1324 (comment), Bind consumes
EVP_PKEY_HMACthough this codepath, so we'll have to add support for this within the EVP_PKEY function pointers.OpenSSL also encourages using
EVP_PKEY_new_raw_private_keyinstead ofEVP_PKEY_new_mac_key: https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_new_mac_key.htmlCall-outs:
N/A
Testing:
New test for
EVP_PKEY_{new,get}_raw_private_keyBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.