svn rev #24198: branches/krb5-1-8/src/lib/crypto/krb/ checksum/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=24198
Commit By: tlyu
Log Message:
ticket: 6751
version_fixed: 1.8.3
status: resolved

pull up r24191 from trunk

 ------------------------------------------------------------------------
 r24191 | ghudson | 2010-07-19 01:01:45 -0400 (Mon, 19 Jul 2010) | 15 lines

 ticket: 6751
 subject: Allow Microsoft HMAC-MD5 checksum types to use non-RC4 keys
 target_version: 1.8.3
 tags: pullup

 In PAC signatures, the hmac-md5 checksum type can be used with AES
 keys.  Make this work by removing the enc field from the hmac-md5 and
 md5-hmac checksum types, and adding a check in
 krb5int_hmacmd5_checksum() for a null key or a key which is longer
 than the hash block size (64 bytes for MD5).  The checksum algorithm
 only uses the key bits; it does invoke the cipher.

 The checksum type names are kind of wrong, but we'll leave them alone
 for compatibility.  The descriptions are updated.


Changed Files:
U   branches/krb5-1-8/src/lib/crypto/krb/checksum/hmac_md5.c
U   branches/krb5-1-8/src/lib/crypto/krb/cksumtypes.c
Modified: branches/krb5-1-8/src/lib/crypto/krb/checksum/hmac_md5.c
===================================================================
--- branches/krb5-1-8/src/lib/crypto/krb/checksum/hmac_md5.c	2010-07-20 22:28:48 UTC (rev 24197)
+++ branches/krb5-1-8/src/lib/crypto/krb/checksum/hmac_md5.c	2010-07-20 22:28:51 UTC (rev 24198)
@@ -48,6 +48,8 @@
     krb5_data ds = empty_data(), hashval = empty_data();
     char t[4];
 
+    if (key == NULL || key->keyblock.length > ctp->hash->blocksize)
+        return KRB5_BAD_ENCTYPE;
     if (ctp->ctype == CKSUMTYPE_HMAC_MD5_ARCFOUR) {
 	/* Compute HMAC(key, "signaturekey\0") to get the signing key ks. */
 	ret = alloc_data(&ds, key->keyblock.length);

Modified: branches/krb5-1-8/src/lib/crypto/krb/cksumtypes.c
===================================================================
--- branches/krb5-1-8/src/lib/crypto/krb/cksumtypes.c	2010-07-20 22:28:48 UTC (rev 24197)
+++ branches/krb5-1-8/src/lib/crypto/krb/cksumtypes.c	2010-07-20 22:28:51 UTC (rev 24198)
@@ -82,8 +82,8 @@
 
     { CKSUMTYPE_HMAC_MD5_ARCFOUR,
       "hmac-md5-rc4", { "hmac-md5-enc", "hmac-md5-earcfour" },
-      "Microsoft HMAC MD5 (RC4 key)",
-      &krb5int_enc_arcfour, &krb5int_hash_md5,
+      "Microsoft HMAC MD5",
+      NULL, &krb5int_hash_md5,
       krb5int_hmacmd5_checksum, NULL,
       16, 16, 0 },
 
@@ -100,8 +100,8 @@
       20, 12, 0 },
 
     { CKSUMTYPE_MD5_HMAC_ARCFOUR,
-      "md5-hmac-rc4", { 0 }, "Microsoft MD5 HMAC (RC4 key)",
-      &krb5int_enc_arcfour, &krb5int_hash_md5,
+      "md5-hmac-rc4", { 0 }, "Microsoft MD5 HMAC",
+      NULL, &krb5int_hash_md5,
       krb5int_hmacmd5_checksum, NULL,
       16, 16, 0 },
 };