Skip to content

Commit 6243d29

Browse files
authored
blake2: Refuse empty keys in keyed hash construction (#510)
1 parent 559d7ff commit 6243d29

File tree

2 files changed

+13
-4
lines changed

2 files changed

+13
-4
lines changed

blake2/src/macros.rs

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -274,9 +274,12 @@ macro_rules! blake2_mac_impl {
274274
{
275275
/// Create new instance using provided key, salt, and persona.
276276
///
277-
/// Key length should not be bigger than block size, salt and persona
278-
/// length should not be bigger than quarter of block size. If any
279-
/// of those conditions is false the method will return an error.
277+
/// # Errors
278+
///
279+
/// Key length should not be empty or bigger than the block size and
280+
/// the salt and persona length should not be bigger than quarter of
281+
/// block size. If any of those conditions is false the method will
282+
/// return an error.
280283
#[inline]
281284
pub fn new_with_salt_and_personal(
282285
key: &[u8],
@@ -286,7 +289,7 @@ macro_rules! blake2_mac_impl {
286289
let kl = key.len();
287290
let bs = <$hash as BlockSizeUser>::BlockSize::USIZE;
288291
let qbs = bs / 4;
289-
if kl > bs || salt.len() > qbs || persona.len() > qbs {
292+
if kl == 0 || kl > bs || salt.len() > qbs || persona.len() > qbs {
290293
return Err(InvalidLength);
291294
}
292295
let mut padded_key = Block::<$hash>::default();

blake2/tests/mac.rs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,9 @@ fn blake2b_new_test() {
2727
run::<blake2::Blake2sMac256>(&[0x42; 32]);
2828
run::<blake2::Blake2bMac512>(&[0x42; 64]);
2929
}
30+
31+
#[test]
32+
fn mac_refuses_empty_keys() {
33+
assert!(blake2::Blake2bMac512::new_with_salt_and_personal(&[], b"salt", b"persona").is_err());
34+
assert!(blake2::Blake2sMac256::new_with_salt_and_personal(&[], b"salt", b"persona").is_err());
35+
}

0 commit comments

Comments
 (0)