svn rev #24191: trunk/src/lib/crypto/krb/ checksum/

[ghudson@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24191
Commit By: ghudson
Log Message:
ticket: 6751
subject: Allow Microsoft HMAC-MD5 checksum types to use non-RC4 keys
target_version: 1.8.3
tags: pullup

In PAC signatures, the hmac-md5 checksum type can be used with AES
keys.  Make this work by removing the enc field from the hmac-md5 and
md5-hmac checksum types, and adding a check in
krb5int_hmacmd5_checksum() for a null key or a key which is longer
than the hash block size (64 bytes for MD5).  The checksum algorithm
only uses the key bits; it does invoke the cipher.

The checksum type names are kind of wrong, but we'll leave them alone
for compatibility.  The descriptions are updated.



Changed Files:
U   trunk/src/lib/crypto/krb/checksum/hmac_md5.c
U   trunk/src/lib/crypto/krb/cksumtypes.c
Modified: trunk/src/lib/crypto/krb/checksum/hmac_md5.c
===================================================================
--- trunk/src/lib/crypto/krb/checksum/hmac_md5.c	2010-07-19 04:30:47 UTC (rev 24190)
+++ trunk/src/lib/crypto/krb/checksum/hmac_md5.c	2010-07-19 05:01:45 UTC (rev 24191)
@@ -48,6 +48,8 @@
     krb5_data ds = empty_data(), hashval = empty_data();
     char t[4];
 
+    if (key == NULL || key->keyblock.length > ctp->hash->blocksize)
+        return KRB5_BAD_ENCTYPE;
     if (ctp->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR) {
 	/* Compute HMAC(key, "signaturekey\0") to get the signing key ks. */
 	ret = alloc_data(&ds, key->keyblock.length);

Modified: trunk/src/lib/crypto/krb/cksumtypes.c
===================================================================
--- trunk/src/lib/crypto/krb/cksumtypes.c	2010-07-19 04:30:47 UTC (rev 24190)
+++ trunk/src/lib/crypto/krb/cksumtypes.c	2010-07-19 05:01:45 UTC (rev 24191)
@@ -82,8 +82,8 @@
 
     { CKSUMTYPE_HMAC_MD5_ARCFOUR,
       "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" },
-      "Microsoft HMAC MD5 (RC4 key)",
-      &krb5int_enc_arcfour, &krb5int_hash_md5,
+      "Microsoft HMAC MD5",
+      NULL, &krb5int_hash_md5,
       krb5int_hmacmd5_checksum, NULL,
       16, 16, 0 },
 
@@ -100,8 +100,8 @@
       20, 12, 0 },
 
     { CKSUMTYPE_MD5_HMAC_ARCFOUR,
-      "md5-hmac-rc4", { 0 }, "Microsoft MD5 HMAC (RC4 key)",
-      &krb5int_enc_arcfour, &krb5int_hash_md5,
+      "md5-hmac-rc4", { 0 }, "Microsoft MD5 HMAC",
+      NULL, &krb5int_hash_md5,
       krb5int_hmacmd5_checksum, NULL,
       16, 16, 0 },
 };