diff options
author | David Benjamin <davidben@chromium.org> | 2014-07-15 08:54:26 +0400 |
---|---|---|
committer | Adam Langley <agl@google.com> | 2014-07-25 01:14:08 +0400 |
commit | 060d9d2c563b3fbe00eff93e5033591504516e6c (patch) | |
tree | 7de2c146ea4bb0fb4d04d6fd6b217f47f02a1565 /ssl/s3_enc.c | |
parent | 5ffeb7c22f367ba0094c3ef886ff6ec13ed63ded (diff) |
Remove support code for export cipher suites.
Now the only case where temporary RSA keys are used on the server end is
non-signing keys.
Change-Id: I55f6c206e798dd28548c386fdffd555ccc395477
Reviewed-on: https://boringssl-review.googlesource.com/1285
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'ssl/s3_enc.c')
-rw-r--r-- | ssl/s3_enc.c | 36 |
1 files changed, 3 insertions, 33 deletions
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c index 24298fd5..ee85c176 100644 --- a/ssl/s3_enc.c +++ b/ssl/s3_enc.c @@ -218,15 +218,13 @@ int ssl3_change_cipher_state(SSL *s, int which) unsigned char *p,*mac_secret; unsigned char exp_key[EVP_MAX_KEY_LENGTH]; unsigned char exp_iv[EVP_MAX_IV_LENGTH]; - unsigned char *ms,*key,*iv,*er1,*er2; + unsigned char *ms,*key,*iv; EVP_CIPHER_CTX *dd; const EVP_CIPHER *c; const EVP_MD *m; - EVP_MD_CTX md; - int is_exp,n,i,j,k,cl; + int n,i,j,k,cl; int reuse_dd = 0; - is_exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher); c=s->s3->tmp.new_sym_enc; m=s->s3->tmp.new_hash; /* m == NULL will lead to a crash later */ @@ -268,8 +266,7 @@ int ssl3_change_cipher_state(SSL *s, int which) p=s->s3->tmp.key_block; i=EVP_MD_size(m); cl=EVP_CIPHER_key_length(c); - j=is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ? - cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl; + j = cl; /* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */ k=EVP_CIPHER_iv_length(c); if ( (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) || @@ -278,8 +275,6 @@ int ssl3_change_cipher_state(SSL *s, int which) ms= &(p[ 0]); n=i+i; key= &(p[ n]); n+=j+j; iv= &(p[ n]); n+=k+k; - er1= &(s->s3->client_random[0]); - er2= &(s->s3->server_random[0]); } else { @@ -287,8 +282,6 @@ int ssl3_change_cipher_state(SSL *s, int which) ms= &(p[ n]); n+=i+j; key= &(p[ n]); n+=j+k; iv= &(p[ n]); n+=k; - er1= &(s->s3->server_random[0]); - er2= &(s->s3->client_random[0]); } if (n > s->s3->tmp.key_block_length) @@ -297,29 +290,7 @@ int ssl3_change_cipher_state(SSL *s, int which) goto err2; } - EVP_MD_CTX_init(&md); memcpy(mac_secret,ms,i); - if (is_exp) - { - /* In here I set both the read and write key/iv to the - * same value since only the correct one will be used :-). - */ - EVP_DigestInit_ex(&md,EVP_md5(), NULL); - EVP_DigestUpdate(&md,key,j); - EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE); - EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE); - EVP_DigestFinal_ex(&md,&(exp_key[0]),NULL); - key= &(exp_key[0]); - - if (k > 0) - { - EVP_DigestInit_ex(&md,EVP_md5(), NULL); - EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE); - EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE); - EVP_DigestFinal_ex(&md,&(exp_iv[0]),NULL); - iv= &(exp_iv[0]); - } - } s->session->key_arg_length=0; @@ -348,7 +319,6 @@ int ssl3_change_cipher_state(SSL *s, int which) OPENSSL_cleanse(&(exp_key[0]),sizeof(exp_key)); OPENSSL_cleanse(&(exp_iv[0]),sizeof(exp_iv)); - EVP_MD_CTX_cleanup(&md); return(1); err: OPENSSL_PUT_ERROR(SSL, ssl3_change_cipher_state, ERR_R_MALLOC_FAILURE); |