/src/botan/src/lib/mac/hmac/hmac.cpp
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * HMAC |
3 | | * (C) 1999-2007,2014,2020 Jack Lloyd |
4 | | * 2007 Yves Jerschow |
5 | | * |
6 | | * Botan is released under the Simplified BSD License (see license.txt) |
7 | | */ |
8 | | |
9 | | #include <botan/internal/hmac.h> |
10 | | #include <botan/internal/ct_utils.h> |
11 | | |
12 | | namespace Botan { |
13 | | |
14 | | /* |
15 | | * Update a HMAC Calculation |
16 | | */ |
17 | | void HMAC::add_data(const uint8_t input[], size_t length) |
18 | 256k | { |
19 | 256k | verify_key_set(m_ikey.empty() == false); |
20 | 256k | m_hash->update(input, length); |
21 | 256k | } |
22 | | |
23 | | /* |
24 | | * Finalize a HMAC Calculation |
25 | | */ |
26 | | void HMAC::final_result(uint8_t mac[]) |
27 | 167k | { |
28 | 167k | verify_key_set(m_okey.empty() == false); |
29 | 167k | m_hash->final(mac); |
30 | 167k | m_hash->update(m_okey); |
31 | 167k | m_hash->update(mac, m_hash_output_length); |
32 | 167k | m_hash->final(mac); |
33 | 167k | m_hash->update(m_ikey); |
34 | 167k | } |
35 | | |
36 | | Key_Length_Specification HMAC::key_spec() const |
37 | 30.4k | { |
38 | | // Support very long lengths for things like PBKDF2 and the TLS PRF |
39 | 30.4k | return Key_Length_Specification(0, 4096); |
40 | 30.4k | } |
41 | | |
42 | | size_t HMAC::output_length() const |
43 | 167k | { |
44 | 167k | return m_hash_output_length; |
45 | 167k | } |
46 | | |
47 | | /* |
48 | | * HMAC Key Schedule |
49 | | */ |
50 | | void HMAC::key_schedule(const uint8_t key[], size_t length) |
51 | 30.4k | { |
52 | 30.4k | const uint8_t ipad = 0x36; |
53 | 30.4k | const uint8_t opad = 0x5C; |
54 | | |
55 | 30.4k | m_hash->clear(); |
56 | | |
57 | 30.4k | m_ikey.resize(m_hash_block_size); |
58 | 30.4k | m_okey.resize(m_hash_block_size); |
59 | | |
60 | 30.4k | clear_mem(m_ikey.data(), m_ikey.size()); |
61 | 30.4k | clear_mem(m_okey.data(), m_okey.size()); |
62 | | |
63 | | /* |
64 | | * Sometimes the HMAC key length itself is sensitive, as with PBKDF2 where it |
65 | | * reveals the length of the passphrase. Make some attempt to hide this to |
66 | | * side channels. Clearly if the secret is longer than the block size then the |
67 | | * branch to hash first reveals that. In addition, counting the number of |
68 | | * compression functions executed reveals the size at the granularity of the |
69 | | * hash function's block size. |
70 | | * |
71 | | * The greater concern is for smaller keys; being able to detect when a |
72 | | * passphrase is say 4 bytes may assist choosing weaker targets. Even though |
73 | | * the loop bounds are constant, we can only actually read key[0..length] so |
74 | | * it doesn't seem possible to make this computation truly constant time. |
75 | | * |
76 | | * We don't mind leaking if the length is exactly zero since that's |
77 | | * trivial to simply check. |
78 | | */ |
79 | | |
80 | 30.4k | if(length > m_hash_block_size) |
81 | 10.4k | { |
82 | 10.4k | m_hash->update(key, length); |
83 | 10.4k | m_hash->final(m_ikey.data()); |
84 | 10.4k | } |
85 | 20.0k | else if(length > 0) |
86 | 20.0k | { |
87 | 1.52M | for(size_t i = 0, i_mod_length = 0; i != m_hash_block_size; ++i) |
88 | 1.50M | { |
89 | | /* |
90 | | access key[i % length] but avoiding division due to variable |
91 | | time computation on some processors. |
92 | | */ |
93 | 1.50M | auto needs_reduction = CT::Mask<size_t>::is_lte(length, i_mod_length); |
94 | 1.50M | i_mod_length = needs_reduction.select(0, i_mod_length); |
95 | 1.50M | const uint8_t kb = key[i_mod_length]; |
96 | | |
97 | 1.50M | auto in_range = CT::Mask<size_t>::is_lt(i, length); |
98 | 1.50M | m_ikey[i] = static_cast<uint8_t>(in_range.if_set_return(kb)); |
99 | 1.50M | i_mod_length += 1; |
100 | 1.50M | } |
101 | 20.0k | } |
102 | | |
103 | 2.23M | for(size_t i = 0; i != m_hash_block_size; ++i) |
104 | 2.20M | { |
105 | 2.20M | m_ikey[i] ^= ipad; |
106 | 2.20M | m_okey[i] = m_ikey[i] ^ ipad ^ opad; |
107 | 2.20M | } |
108 | | |
109 | 30.4k | m_hash->update(m_ikey); |
110 | 30.4k | } |
111 | | |
112 | | /* |
113 | | * Clear memory of sensitive data |
114 | | */ |
115 | | void HMAC::clear() |
116 | 0 | { |
117 | 0 | m_hash->clear(); |
118 | 0 | zap(m_ikey); |
119 | 0 | zap(m_okey); |
120 | 0 | } |
121 | | |
122 | | /* |
123 | | * Return the name of this type |
124 | | */ |
125 | | std::string HMAC::name() const |
126 | 396 | { |
127 | 396 | return "HMAC(" + m_hash->name() + ")"; |
128 | 396 | } |
129 | | |
130 | | /* |
131 | | * Return a new_object of this object |
132 | | */ |
133 | | std::unique_ptr<MessageAuthenticationCode> HMAC::new_object() const |
134 | 0 | { |
135 | 0 | return std::make_unique<HMAC>(m_hash->new_object()); |
136 | 0 | } |
137 | | |
138 | | /* |
139 | | * HMAC Constructor |
140 | | */ |
141 | | HMAC::HMAC(std::unique_ptr<HashFunction> hash) : |
142 | | m_hash(std::move(hash)), |
143 | | m_hash_output_length(m_hash->output_length()), |
144 | | m_hash_block_size(m_hash->hash_block_size()) |
145 | 16.8k | { |
146 | 16.8k | BOTAN_ARG_CHECK(m_hash_block_size >= m_hash_output_length, |
147 | 16.8k | "HMAC is not compatible with this hash function"); |
148 | 16.8k | } |
149 | | |
150 | | } |