Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: aa9c88b9f60ffdc413cabcdfa91267a07acee447
https://github.com/WebKit/WebKit/commit/aa9c88b9f60ffdc413cabcdfa91267a07acee447
Author: Claudio Saavedra <[email protected]>
Date: 2026-10-04 (Sun, 04 Oct 2026)
Changed paths:
M Source/WebCore/crypto/openssl/CryptoAlgorithmHKDFOpenSSL.cpp
Log Message:
-----------
[OpenSSL] HKDF fails with an empty key or salt
https://bugs.webkit.org/show_bug.cgi?id=326089
Reviewed by Patrick Griffis.
The HKDF wrapper used with OpenSSL passes the key and salt buffers to
EVP_PKEY_CTX_set1_hkdf_key() and EVP_PKEY_CTX_set1_hkdf_salt() as pointer
and length. For an empty Vector the pointer is null, and OpenSSL 3 rejects a
null pointer regardless of the length, so deriveBits() and deriveKey() fail
with OperationError whenever the base key or the salt is empty. RFC 5869
makes the salt optional and sets no minimum length for the keying material,
and the WPT HKDF tests cover both: every derivation with an empty key or
salt fails on a build using OpenSSL.
Skip the salt call when the salt is empty, since OpenSSL then runs the
extract step with an empty HMAC key, which gives the same result as the
HashLen zero bytes the RFC specifies, and pass a non-null pointer for an
empty key.
No bot builds this wrapper: Windows uses LibreSSL and PlayStation BoringSSL,
both of which provide HKDF() in <openssl/hkdf.h> and take the other branch
of the #if above.
Verified on a WPE build with USE_OPENSSL_BACKEND=ON against OpenSSL 3.5.5:
the eight hkdf.https.any.html shards reported 1088 failing subtests, all
with an empty key or salt, and none after this change.
* Source/WebCore/crypto/openssl/CryptoAlgorithmHKDFOpenSSL.cpp:
(HKDF):
Canonical link: https://commits.webkit.org/322640@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
