Re: Calculating HMAC for a key based on password and salt

Phil Arcuri <[email protected]> writes:

>Is this a general bug for which we should apply the fix you give below? Or
>should we wait for the next incremental release? Asking this another way - is
>the risk of making this change to our code less than leaving it "as is" and
>living with this bug?

It won't hurt anything to apply it, but since this had gone unnoticed for
several years now it also seems unlikely that anyone else ever used this
capability.  When cryptlib uses HMAC (e.g. in SSL/TLS, SSH, private-key
storage, envelopes, CMP, and others) it does its own key management, it never
derives a key directly from a password, so it would also never trigger this.

Peter.

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.