I just tripped over a nasty bug in OpenSSL's CMAC implementation, present from 1.1.0 onward and now likely to be fixed in 1.1.0f. I thought I'd give you a heads up in order to save you some sanity when you're implementing draft-aanchal4-ntp-mac.
https://github.com/openssl/openssl/pull/2798 The bug is that CMAC_CTX_cleanup() makes an inappropriate call to free. As a result, you'll later end up with a double free when you call CMAC_CTX_free() on the same context object. You can work around this problem by avoiding calls to CMAC_CTX_cleanup() in affected versions, and instead simulating them by calling CMAC_CTX_free() followed by CMAC_CTX_new(), like so: #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ OPENSSL_VERSION_NUMBER < 0x10100060L CMAC_CTX_free(ctx); ctx = CMAC_CTX_new(); #else CMAC_CTX_cleanup(ctx); #endif CMAC_CTX_free() internally contains a call to CMAC_CTX_cleanup() in a manner that doesn't trigger the bug, so this workaround still correctly results in sensitive data being zeroed out before it's freed. It is however considerably less efficient since it performs an unnecessary malloc. _______________________________________________ devel mailing list [email protected] http://lists.ntpsec.org/mailman/listinfo/devel
