{"push_id":2010702095,"size":1,"distinct_size":1,"ref":"refs/heads/svn_head","head":"5371642325f56ea410be85279986e67cf14e6c05","before":"af2628e4678ebe4c03148db2f63bc104fb35f343","commits":[{"sha":"5371642325f56ea410be85279986e67cf14e6c05","author":{"name":"cem","email":"af7db0ed4336d177a834fba8f4630f263ff96ae4@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f"},"message":"opencrypto: Loosen restriction on HMAC key sizes\n\nTheoretically, HMACs do not actually have any limit on key sizes.\nTransforms should compact input keys larger than the HMAC block size by\nusing the transform (hash) on the input key.\n\n(Short input keys are padded out with zeros to the HMAC block size.)\n\nStill, not all FreeBSD crypto drivers that provide HMAC functionality\nhandle longer-than-blocksize keys appropriately, so enforce a \"maximum\" key\nlength in the crypto API for auth_hashes that previously expressed a\nrequirement.  (The \"maximum\" is the size of a single HMAC block for the\ngiven transform.)  Unconstrained auth_hashes are left as-is.\n\nI believe the previous hardcoded sizes were committed in the original\nimport of opencrypto from OpenBSD and are due to specific protocol\ndetails of IPSec.  Note that none of the previous sizes actually matched\nthe appropriate HMAC block size.\n\nThe previous hardcoded sizes made the SHA tests in cryptotest.py\nuseless for testing FreeBSD crypto drivers; none of the NIST-KAT example\ninputs had keys sized to the previous expectations.\n\nThe following drivers were audited to check that they handled keys up to\nthe block size of the HMAC safely:\n\n  Software HMAC:\n    * padlock(4)\n    * cesa\n    * glxsb\n    * safe(4)\n    * ubsec(4)\n\n  Hardware accelerated HMAC:\n    * ccr(4)\n    * hifn(4)\n    * sec(4) (Only supports up to 64 byte keys despite claiming to\n      support SHA2 HMACs, but validates input key sizes)\n    * cryptocteon (MIPS)\n    * nlmsec (MIPS)\n    * rmisec (MIPS) (Amusingly, does not appear to use key material at\n      all -- presumed broken)\n\nReviewed by:\tjhb (previous version), rlibby (previous version)\nSponsored by:\tDell EMC Isilon\nDifferential Revision:\thttps://reviews.freebsd.org/D12437\n\n\ngit-svn-id: svn+ssh://svn.freebsd.org/base/head@324017 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f","distinct":true,"url":"https://api.github.com/repos/freebsd/freebsd/commits/5371642325f56ea410be85279986e67cf14e6c05"}]}
{"actor":{"display_login":"uqs"}}