Skip to content

master branch: EVP_PKEY_new_mac_key fails with 0-length key #13089

@ngg

Description

@ngg

The following function call returns NULL on the current master branch.
OpenSSL 1.1.1 versions (and also 3.0.0 alpha6) returned a valid EVP_PKEY* pointer.

EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, (const unsigned char*)"", 0);

I think this was an unintentional change during the provider refactor.
Using empty keys is not really useful, I'm not sure how this affects others, we found this issue with our tests that tried to use empty keys as well.

Full test code to reproduce:

#include <string.h>
#include <stdio.h>

#include "openssl/evp.h"

int test(const char* key_str)
{
  EVP_PKEY* key = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL,
                                       (const unsigned char*) key_str, strlen(key_str));
  if (!key) return 1;

  EVP_MD_CTX* ctx = EVP_MD_CTX_new();
  if (!ctx) return 2;
  const EVP_MD* md = EVP_sha512();
  if (!md) return 3;

  EVP_PKEY_CTX* evpPkeyCtxPtr;
  if (!EVP_DigestSignInit(ctx, &evpPkeyCtxPtr, md, NULL, key)) return 4;

  if (!EVP_DigestSignUpdate(ctx, "message", 7)) return 5;

  unsigned char sign[1024];
  size_t sign_len = 1024;
  if (!EVP_DigestSignFinal(ctx, sign, &sign_len)) return 6;

  EVP_PKEY_free(key);
  EVP_MD_CTX_free(ctx);
  return 0;
}

int main()
{
  printf("key: %d\n", test("key"));
  printf("empty key: %d\n", test(""));
  return 0;
}

Output of the sample program on master branch:

key: 0
empty key: 1

Output when using OpenSSL 1.1.1h or 3.0.0-alpha6:

key: 0
empty key: 0

Metadata

Metadata

Assignees

No one assigned

    Labels

    backlog fixThe issue was closed as part of the backlog reduction initiative.branch: 3.0Applies to openssl-3.0 branchbranch: 3.1Applies to openssl-3.1 (EOL)branch: 3.2Applies to openssl-3.2 (EOL)branch: masterApplies to master branchhelp wantedresolved: wont fixThe issue has been confirmed but won't be fixedseverity: regressionThe issue/pr is a regression from previous released versiontriaged: bugThe issue/pr is/fixes a bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions