diff options
| author | Joel Sing <jsing@cvs.openbsd.org> | 2014-06-13 16:09:16 +0000 |
|---|---|---|
| committer | Joel Sing <jsing@cvs.openbsd.org> | 2014-06-13 16:09:16 +0000 |
| commit | b54e46cbd7844363db473626c42e6cd9ac3c1536 (patch) | |
| tree | 4ddc8069aff205814eb5d09ea31801d6a2bd3a30 | |
| parent | 7b1ede4b15c815b44a3c9f2d6e8f8beeb5d0f7c1 (diff) | |
Correctly calculate the key block length when using export ciphers.
| -rw-r--r-- | lib/libssl/t1_enc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/lib/libssl/t1_enc.c b/lib/libssl/t1_enc.c index 7b6c9b7ac68..fe8ccab23e7 100644 --- a/lib/libssl/t1_enc.c +++ b/lib/libssl/t1_enc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: t1_enc.c,v 1.58 2014/06/13 14:32:35 jsing Exp $ */ +/* $OpenBSD: t1_enc.c,v 1.59 2014/06/13 16:09:15 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -697,6 +697,10 @@ tls1_setup_key_block(SSL *s) key_len = EVP_CIPHER_key_length(cipher); iv_len = EVP_CIPHER_iv_length(cipher); + if (SSL_C_IS_EXPORT(s->session->cipher) && + key_len > SSL_C_EXPORT_KEYLENGTH(s->session->cipher)) + key_len = SSL_C_EXPORT_KEYLENGTH(s->session->cipher); + /* If GCM mode only part of IV comes from PRF. */ if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE) iv_len = EVP_GCM_TLS_FIXED_IV_LEN; |