SSLv3 s2n_hmac_test uses keys of the wrong lengths
- Dominant language
- C
- Stars
- 4.8k
- Forks
- 802
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 33
Description
https://github.com/awslabs/s2n/blob/master/tests/unit/s2n_hmac_test.c#L32
In SSLv3, the size of the key is fixed to be the same as the output size of the hash function, so the keys should be 16 bytes for md5 and 20 for sha1.
In addition to fixing the test, might be a good idea to add a check in the init code to ensure that the sslv3 keys are the right length
Contributor guide
Research direction
Start with tests/unit/s2n_hmac_test.c at line 32 and inspect the SSLv3 HMAC test setup and related initialization code. Update the MD5 and SHA1 key lengths to match their hash output sizes, then determine whether initialization should reject other SSLv3 key lengths. Run the relevant HMAC tests to verify the corrected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100