Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PBKDF2 hang (very long loop) if iterations == 0 #2088

Closed
guidovranken opened this issue Aug 30, 2019 · 2 comments
Closed

PBKDF2 hang (very long loop) if iterations == 0 #2088

guidovranken opened this issue Aug 30, 2019 · 2 comments
Labels

Comments

@guidovranken
Copy link

#include <botan/pbkdf.h>
#include <botan/pwdhash.h>

#define CF_CHECK_NE(expr, res) if ( (expr) == (res) ) { goto end; }
int main(void)
{
    std::unique_ptr<::Botan::PasswordHashFamily> pwdhash_fam = nullptr;
    std::unique_ptr<::Botan::PasswordHash> pwdhash = nullptr;
    uint8_t out[1];
    char key[8] = { 0 };
    uint8_t salt[8] = { 0 };

    /* Initialize */
    {
        CF_CHECK_NE(pwdhash_fam = ::Botan::PasswordHashFamily::create("PBKDF2(SHA-256)"), nullptr);
        CF_CHECK_NE(pwdhash = pwdhash_fam->from_params(0), nullptr);
    }
    /* Process */
    {
        pwdhash->derive_key(
                out,
                1,
                key,
                sizeof(key),
                salt,
                sizeof(salt));
    }

end:
    return 0;
}

I think it might be more appropriate to throw an exception?

@randombit randombit added the bug label Aug 30, 2019
randombit added a commit that referenced this issue Aug 31, 2019
It would go into a very long loop.

OpenSSL treats iterations==0 same as iterations==1 but this seems
confusing. Instead just reject it.

Unrelated, fix a divide by zero if asked to tune with 0 byte output.

Closes GH #2088
@randombit
Copy link
Owner

Fixed now in #2090 thanks!

@guidovranken
Copy link
Author

You're welcome

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants