Ensure HMAC_Init_ex reinitializes data properly#2806
Merged
Conversation
f9f4eb0 to
d0115b3
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2806 +/- ##
==========================================
- Coverage 78.42% 78.25% -0.18%
==========================================
Files 683 683
Lines 116286 117182 +896
Branches 16401 16474 +73
==========================================
+ Hits 91197 91696 +499
- Misses 24215 24605 +390
- Partials 874 881 +7 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
justsmth
reviewed
Nov 10, 2025
094c5e6 to
c405267
Compare
c405267 to
1147ddc
Compare
justsmth
previously approved these changes
Nov 10, 2025
1147ddc to
cc14756
Compare
WillChilds-Klein
previously approved these changes
Nov 10, 2025
nebeid
reviewed
Nov 11, 2025
d7740c2
cc14756 to
d7740c2
Compare
d7740c2 to
7642806
Compare
justsmth
approved these changes
Nov 11, 2025
WillChilds-Klein
approved these changes
Nov 11, 2025
sgmenda
pushed a commit
to sgmenda/aws-lc
that referenced
this pull request
Nov 11, 2025
### Description of changes: I discovered this edge case when working with an older Ruby version. This discrepancy only exists in older versions since Ruby openssl migrated from using the `HMAC_CTX` APIs to use the `EVP` layer in 3.1: ruby/ruby@b91f62f. [`test_reset_keep_key`](https://github.com/ruby/ruby/blame/cf4a034d59913fb71a7dd1b052164984be4a3d14/test/openssl/test_hmac.rb#L37-L43) was failing since we were MACing the data twice. It turns out the call to `h1.reset` wasn't working properly and this was due to our implementation of `HMAC_Init_ex` not reinitializing the data input when only `HMAC_Update` had been called. According to the original function contract, `HMAC_Init_ex` should reinitialize the inputted data, but the computed key should still be preserved. This is a minor edge case due to how older versions of Ruby were consuming `HMAC_CTX`. [Their call](https://github.com/ruby/ruby/blob/ruby_2_7/ext/openssl/ossl_hmac.c#L167-L174) to `HMAC_Final` was called upon a copy of the original `HMAC_CTX`. The original `HMAC_CTX` was always within a `HMAC_Update` state and AWS-LC was not properly reinitializing these cases. ### Call-outs: N/A ### Testing: New tests By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes:
I discovered this edge case when working with an older Ruby version. This discrepancy only exists in older versions since Ruby openssl migrated from using the
HMAC_CTXAPIs to use theEVPlayer in 3.1: ruby/ruby@b91f62f.test_reset_keep_keywas failing since we were MACing the data twice. It turns out the call toh1.resetwasn't working properly and this was due to our implementation ofHMAC_Init_exnot reinitializing the data input when onlyHMAC_Updatehad been called. According to the original function contract,HMAC_Init_exshould reinitialize the inputted data, but the computed key should still be preserved.This is a minor edge case due to how older versions of Ruby were consuming
HMAC_CTX. Their call toHMAC_Finalwas called upon a copy of the originalHMAC_CTX. The originalHMAC_CTXwas always within aHMAC_Updatestate and AWS-LC was not properly reinitializing these cases.Call-outs:
N/A
Testing:
New tests
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.