summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--openbsd-compat/bcrypt_pbkdf.c26
1 files changed, 15 insertions, 11 deletions
diff --git a/openbsd-compat/bcrypt_pbkdf.c b/openbsd-compat/bcrypt_pbkdf.c
index 91b6ba07b..5ed1cc531 100644
--- a/openbsd-compat/bcrypt_pbkdf.c
+++ b/openbsd-compat/bcrypt_pbkdf.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: bcrypt_pbkdf.c,v 1.4 2013/07/29 00:55:53 tedu Exp $ */ 1/* $OpenBSD: bcrypt_pbkdf.c,v 1.9 2014/07/13 21:21:25 tedu Exp $ */
2/* 2/*
3 * Copyright (c) 2013 Ted Unangst <tedu@openbsd.org> 3 * Copyright (c) 2013 Ted Unangst <tedu@openbsd.org>
4 * 4 *
@@ -51,8 +51,8 @@
51 * 51 *
52 * One modification from official pbkdf2. Instead of outputting key material 52 * One modification from official pbkdf2. Instead of outputting key material
53 * linearly, we mix it. pbkdf2 has a known weakness where if one uses it to 53 * linearly, we mix it. pbkdf2 has a known weakness where if one uses it to
54 * generate (i.e.) 512 bits of key material for use as two 256 bit keys, an 54 * generate (e.g.) 512 bits of key material for use as two 256 bit keys, an
55 * attacker can merely run once through the outer loop below, but the user 55 * attacker can merely run once through the outer loop, but the user
56 * always runs it twice. Shuffling output bytes requires computing the 56 * always runs it twice. Shuffling output bytes requires computing the
57 * entirety of the key material to assemble any subkey. This is something a 57 * entirety of the key material to assemble any subkey. This is something a
58 * wise caller could do; we just do it for you. 58 * wise caller could do; we just do it for you.
@@ -97,9 +97,9 @@ bcrypt_hash(u_int8_t *sha2pass, u_int8_t *sha2salt, u_int8_t *out)
97 } 97 }
98 98
99 /* zap */ 99 /* zap */
100 memset(ciphertext, 0, sizeof(ciphertext)); 100 explicit_bzero(ciphertext, sizeof(ciphertext));
101 memset(cdata, 0, sizeof(cdata)); 101 explicit_bzero(cdata, sizeof(cdata));
102 memset(&state, 0, sizeof(state)); 102 explicit_bzero(&state, sizeof(state));
103} 103}
104 104
105int 105int
@@ -113,6 +113,7 @@ bcrypt_pbkdf(const char *pass, size_t passlen, const u_int8_t *salt, size_t salt
113 u_int8_t *countsalt; 113 u_int8_t *countsalt;
114 size_t i, j, amt, stride; 114 size_t i, j, amt, stride;
115 uint32_t count; 115 uint32_t count;
116 size_t origkeylen = keylen;
116 117
117 /* nothing crazy */ 118 /* nothing crazy */
118 if (rounds < 1) 119 if (rounds < 1)
@@ -155,14 +156,17 @@ bcrypt_pbkdf(const char *pass, size_t passlen, const u_int8_t *salt, size_t salt
155 * pbkdf2 deviation: ouput the key material non-linearly. 156 * pbkdf2 deviation: ouput the key material non-linearly.
156 */ 157 */
157 amt = MIN(amt, keylen); 158 amt = MIN(amt, keylen);
158 for (i = 0; i < amt; i++) 159 for (i = 0; i < amt; i++) {
159 key[i * stride + (count - 1)] = out[i]; 160 size_t dest = i * stride + (count - 1);
160 keylen -= amt; 161 if (dest >= origkeylen)
162 break;
163 key[dest] = out[i];
164 }
165 keylen -= i;
161 } 166 }
162 167
163 /* zap */ 168 /* zap */
164 memset(out, 0, sizeof(out)); 169 explicit_bzero(out, sizeof(out));
165 memset(countsalt, 0, saltlen + 4);
166 free(countsalt); 170 free(countsalt);
167 171
168 return 0; 172 return 0;