rdugal at certicom
Sep 7, 2011, 7:01 AM
Post #3 of 3
(201 views)
Permalink
|
|
RE: mac_int() does not call HMAC_CTX_init()
[In reply to]
|
|
No, I did not file a bug last year. I have just filed bug 1934.
--
Robert Dugal Team Lead SSL & PKI Group
Certicom Corp. A Subsidiary of Research In Motion
4701 Tahoe Blvd., Building A
Mississauga, ON
L4W 0B5
rdugal [at] certicom
direct +1.289.261.4148
mobile +1.416.276.8062
main +1.905.507.4220
fax +1.905.507.4230
www.certicom.com
-----Original Message-----
From: Iain Morgan [mailto:imorgan [at] nas]
Sent: Tuesday, September 06, 2011 5:44 PM
To: Robert Dugal
Cc: openssh-unix-dev [at] mindrot
Subject: Re: mac_int() does not call HMAC_CTX_init()
Did you file a bug with bugzilla.mindrot.org? If not, it could easily
get overlooked regardless of whether or not the email made it to the
mailing list.
--
Iain
On Tue, Sep 06, 2011 at 09:36:51 -0500, Robert Dugal wrote:
> Last year I sent the email below describing a bug in openssh 5.6p1.
> I just noticed this bug still exists in 5.9p1.
>
> Probably my earlier email was treated as spam because it was in HTML format.
>
>
> --
> Robert Dugal Team Lead SSL & PKI Group
> Certicom Corp. A Subsidiary of Research In Motion
> 4701 Tahoe Blvd., Building A
> Mississauga, ON
> L4W 0B5
>
> rdugal [at] certicom
> direct +1.289.261.4148
> mobile +1.416.276.8062
> main +1.905.507.4220
> fax +1.905.507.4230
> www.certicom.com
>
>
>
>
>
> From: Robert Dugal
> Sent: Wednesday, September 29, 2010 1:02 PM
> To: openssh-unix-dev [at] mindrot
> Subject: bug in openssh - mac_int() does not call HMAC_CTX_init()
>
> I have been doing some work with OpenSSH 5.6p1, attempting to use an alternative engine for crypto.
> In mac.c, the function mac_init() calls HMAC_Init() without previously having called HMAC_CTX_init().
> However, OpenSSL documentation states that HMAC_CTX_init() is mandatory.
>
> http://www.openssl.org/docs/crypto/hmac.html
>
> HMAC_CTX_init() initialises a HMAC_CTX before first use. It must be called.
> HMAC_CTX_init() must have been called before the first use of an HMAC_CTX in this function. N.B. HMAC_Init() had this undocumented behaviour in previous versions of OpenSSL - failure to switch to HMAC_Init_ex() in programs that expect it will cause them to stop working
>
> While this appears to cause no issues with OpenSSH 5.6p1 using OpenSSL 1.0.0a and the default crypto engine,
> it may cause problems (such as segfaults in my case) when attempting to use an alternative engine.
> --
> Robert Dugal Senior Software Developer
> Certicom Corp. A Subsidiary of Research In Motion
> rdugal [at] certicom
> direct 905.501.3848
> fax 905.507.4230
> www.certicom.com
>
>
> ---------------------------------------------------------------------
> This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev [at] mindrot
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
--
Iain Morgan
---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev [at] mindrot
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
|
