Remove support code for export cipher suites.

Now the only case where temporary RSA keys are used on the server end is
non-signing keys.

Change-Id: I55f6c206e798dd28548c386fdffd555ccc395477
Reviewed-on: https://boringssl-review.googlesource.com/1285
Reviewed-by: Adam Langley <agl@google.com>

1 files changed, 3 insertions, 33 deletions

diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 24298fd5..ee85c176 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -218,15 +218,13 @@ int ssl3_change_cipher_state(SSL *s, int which)
 	unsigned char *p,*mac_secret;
 	unsigned char exp_key[EVP_MAX_KEY_LENGTH];
 	unsigned char exp_iv[EVP_MAX_IV_LENGTH];
-	unsigned char *ms,*key,*iv,*er1,*er2;
+	unsigned char *ms,*key,*iv;
 	EVP_CIPHER_CTX *dd;
 	const EVP_CIPHER *c;
 	const EVP_MD *m;
-	EVP_MD_CTX md;
-	int is_exp,n,i,j,k,cl;
+	int n,i,j,k,cl;
 	int reuse_dd = 0;
 
-	is_exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
 	c=s->s3->tmp.new_sym_enc;
 	m=s->s3->tmp.new_hash;
 	/* m == NULL will lead to a crash later */
@@ -268,8 +266,7 @@ int ssl3_change_cipher_state(SSL *s, int which)
 	p=s->s3->tmp.key_block;
 	i=EVP_MD_size(m);
 	cl=EVP_CIPHER_key_length(c);
-	j=is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
-		 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
+	j = cl;
 	/* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */
 	k=EVP_CIPHER_iv_length(c);
 	if (	(which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
@@ -278,8 +275,6 @@ int ssl3_change_cipher_state(SSL *s, int which)
 		ms=  &(p[ 0]); n=i+i;
 		key= &(p[ n]); n+=j+j;
 		iv=  &(p[ n]); n+=k+k;
-		er1= &(s->s3->client_random[0]);
-		er2= &(s->s3->server_random[0]);
 		}
 	else
 		{
@@ -287,8 +282,6 @@ int ssl3_change_cipher_state(SSL *s, int which)
 		ms=  &(p[ n]); n+=i+j;
 		key= &(p[ n]); n+=j+k;
 		iv=  &(p[ n]); n+=k;
-		er1= &(s->s3->server_random[0]);
-		er2= &(s->s3->client_random[0]);
 		}
 
 	if (n > s->s3->tmp.key_block_length)
@@ -297,29 +290,7 @@ int ssl3_change_cipher_state(SSL *s, int which)
 		goto err2;
 		}
 
-	EVP_MD_CTX_init(&md);
 	memcpy(mac_secret,ms,i);
-	if (is_exp)
-		{
-		/* In here I set both the read and write key/iv to the
-		 * same value since only the correct one will be used :-).
-		 */
-		EVP_DigestInit_ex(&md,EVP_md5(), NULL);
-		EVP_DigestUpdate(&md,key,j);
-		EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE);
-		EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE);
-		EVP_DigestFinal_ex(&md,&(exp_key[0]),NULL);
-		key= &(exp_key[0]);
-
-		if (k > 0)
-			{
-			EVP_DigestInit_ex(&md,EVP_md5(), NULL);
-			EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE);
-			EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE);
-			EVP_DigestFinal_ex(&md,&(exp_iv[0]),NULL);
-			iv= &(exp_iv[0]);
-			}
-		}
 
 	s->session->key_arg_length=0;
 
@@ -348,7 +319,6 @@ int ssl3_change_cipher_state(SSL *s, int which)
 
 	OPENSSL_cleanse(&(exp_key[0]),sizeof(exp_key));
 	OPENSSL_cleanse(&(exp_iv[0]),sizeof(exp_iv));
-	EVP_MD_CTX_cleanup(&md);
 	return(1);
 err:
 	OPENSSL_PUT_ERROR(SSL, ssl3_change_cipher_state, ERR_R_MALLOC_FAILURE);