From 0def528bc502a888a3f4ef3c38ea4c5e69fd7375 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 24 Jun 2016 10:31:08 +0100 Subject: [PATCH] Ensure HMAC key gets cleansed after use aesni_cbc_hmac_sha256_ctrl() and aesni_cbc_hmac_sha1_ctrl() cleanse the HMAC key after use, but static int rc4_hmac_md5_ctrl() doesn't. Fixes an OCAP Audit issue. Reviewed-by: Andy Polyakov --- crypto/evp/e_rc4_hmac_md5.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c index 28b12c7c26..832daef178 100644 --- a/crypto/evp/e_rc4_hmac_md5.c +++ b/crypto/evp/e_rc4_hmac_md5.c @@ -213,6 +213,8 @@ static int rc4_hmac_md5_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, MD5_Init(&key->tail); MD5_Update(&key->tail, hmac_key, sizeof(hmac_key)); + OPENSSL_cleanse(hmac_key, sizeof(hmac_key)); + return 1; } case EVP_CTRL_AEAD_TLS1_AAD: -- 2.25.1