Wrong hmac values from crypto_data_hash

General
1

Posting here to get attentions to the issue that I filed :slight_smile: : Wrong hmac values when the key contains "null" bytes · Issue #170 · SWI-Prolog/packages-ssl · GitHub.

When crypto_data_hash is called with the hmac(Key) option, and when Key contains null bytes, the resulting value is wrong. That’s because the underlying C code treats the key as a C-string and uses strlen to calculate the key length. strlen thinks the key is terminated by the null byte.

The key can contain null bytes when the key is a binary data, especially when the key is derived from key-derivation-functions such as scrypt, bcrypt, etc.

Would anyone familiar with the code base be kind enough to fix this? :slight_smile:

2

Pushed a fix. I don’t know much about the crypto predicates. The code suggests the key is expected to be a normal key without 0-bytes. Anyway, it works fine with 0-bytes now. The choice was between supporting them or raising an error when the key contains 0-bytes. Just returning the wrong result is not an option :slight_smile:

2 Likes
3

Woohoo! It was quick! Thank you, Jan.