From afbb4f2a0af1167e93f6fb76c3b905643b9a6a47 Mon Sep 17 00:00:00 2001 From: Vladislav Sapegin Date: Tue, 31 Mar 2026 21:42:05 +0300 Subject: [PATCH 1/2] refactor: use EVP_MAC in gost_tls12_additional_kdftree --- gost_tls12_additional_kdftree.c | 43 +++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 16 deletions(-) diff --git a/gost_tls12_additional_kdftree.c b/gost_tls12_additional_kdftree.c index 01c747eb9..b9cda9fa6 100644 --- a/gost_tls12_additional_kdftree.c +++ b/gost_tls12_additional_kdftree.c @@ -1,9 +1,10 @@ #include #include +#include #include #include -#include +#include #include "gost_tls12_additional.h" #include "e_gost_err.h" @@ -29,19 +30,28 @@ int gost_kdftree2012_256(unsigned char *keyout, size_t keyout_len, int iters, i = 0; unsigned char zero = 0; unsigned char *ptr = keyout; - HMAC_CTX *ctx; + EVP_MAC *mac = NULL; + EVP_MAC_CTX *ctx = NULL; unsigned char *len_ptr = NULL; uint32_t len_repr = be32(keyout_len * 8); size_t len_repr_len = 4; + OSSL_PARAM params[] = { + OSSL_PARAM_utf8_string(OSSL_MAC_PARAM_DIGEST, + (char *)SN_id_GostR3411_2012_256, 0), + OSSL_PARAM_END + }; - ctx = HMAC_CTX_new(); - if (ctx == NULL) { + mac = EVP_MAC_fetch(NULL, OSSL_MAC_NAME_HMAC, NULL); + if (mac == NULL || (ctx = EVP_MAC_CTX_new(mac)) == NULL) { GOSTerr(GOST_F_GOST_KDFTREE2012_256, ERR_R_MALLOC_FAILURE); + EVP_MAC_free(mac); return 0; } if ((keyout_len == 0) || (keyout_len % 32 != 0)) { GOSTerr(GOST_F_GOST_KDFTREE2012_256, ERR_R_INTERNAL_ERROR); + EVP_MAC_CTX_free(ctx); + EVP_MAC_free(mac); return 0; } iters = keyout_len / 32; @@ -56,26 +66,27 @@ int gost_kdftree2012_256(unsigned char *keyout, size_t keyout_len, uint32_t iter_net = be32(i); unsigned char *rep_ptr = ((unsigned char *)&iter_net) + (4 - representation); + size_t out_len = 0; - if (HMAC_Init_ex(ctx, key, keylen, - EVP_get_digestbynid(NID_id_GostR3411_2012_256), - NULL) <= 0 - || HMAC_Update(ctx, rep_ptr, representation) <= 0 - || HMAC_Update(ctx, label, label_len) <= 0 - || HMAC_Update(ctx, &zero, 1) <= 0 - || HMAC_Update(ctx, seed, seed_len) <= 0 - || HMAC_Update(ctx, len_ptr, len_repr_len) <= 0 - || HMAC_Final(ctx, ptr, NULL) <= 0) { + if (EVP_MAC_init(ctx, key, keylen, params) <= 0 + || EVP_MAC_update(ctx, rep_ptr, representation) <= 0 + || EVP_MAC_update(ctx, label, label_len) <= 0 + || EVP_MAC_update(ctx, &zero, 1) <= 0 + || EVP_MAC_update(ctx, seed, seed_len) <= 0 + || EVP_MAC_update(ctx, len_ptr, len_repr_len) <= 0 + || EVP_MAC_final(ctx, ptr, &out_len, 32) <= 0 + || out_len != 32) { GOSTerr(GOST_F_GOST_KDFTREE2012_256, ERR_R_INTERNAL_ERROR); - HMAC_CTX_free(ctx); + EVP_MAC_CTX_free(ctx); + EVP_MAC_free(mac); return 0; } - HMAC_CTX_reset(ctx); ptr += 32; } - HMAC_CTX_free(ctx); + EVP_MAC_CTX_free(ctx); + EVP_MAC_free(mac); return 1; } From 7fda7e7eaddfaa6eb7d29cb15caf62a9f67b0eca Mon Sep 17 00:00:00 2001 From: VladGud <55700257+VladGud@users.noreply.github.com> Date: Thu, 2 Apr 2026 14:44:55 +0300 Subject: [PATCH 2/2] Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- gost_tls12_additional_kdftree.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/gost_tls12_additional_kdftree.c b/gost_tls12_additional_kdftree.c index b9cda9fa6..7f7029617 100644 --- a/gost_tls12_additional_kdftree.c +++ b/gost_tls12_additional_kdftree.c @@ -42,7 +42,13 @@ int gost_kdftree2012_256(unsigned char *keyout, size_t keyout_len, }; mac = EVP_MAC_fetch(NULL, OSSL_MAC_NAME_HMAC, NULL); - if (mac == NULL || (ctx = EVP_MAC_CTX_new(mac)) == NULL) { + if (mac == NULL) { + GOSTerr(GOST_F_GOST_KDFTREE2012_256, ERR_R_INTERNAL_ERROR); + return 0; + } + + ctx = EVP_MAC_CTX_new(mac); + if (ctx == NULL) { GOSTerr(GOST_F_GOST_KDFTREE2012_256, ERR_R_MALLOC_FAILURE); EVP_MAC_free(mac); return 0;