[openssl-commits] [openssl] master update

Matt Caswell matt at openssl.org
Fri Jun 24 12:30:29 UTC 2016

The branch master has been updated
       via  0def528bc502a888a3f4ef3c38ea4c5e69fd7375 (commit)
      from  827d17f0210e6721be9834220be1e31b75b0b272 (commit)

- Log -----------------------------------------------------------------
commit 0def528bc502a888a3f4ef3c38ea4c5e69fd7375
Author: Matt Caswell <matt at openssl.org>
Date:   Fri Jun 24 10:31:08 2016 +0100

    Ensure HMAC key gets cleansed after use
    aesni_cbc_hmac_sha256_ctrl() and aesni_cbc_hmac_sha1_ctrl() cleanse the
    HMAC key after use, but static int rc4_hmac_md5_ctrl() doesn't.
    Fixes an OCAP Audit issue.
    Reviewed-by: Andy Polyakov <appro at openssl.org>


Summary of changes:
 crypto/evp/e_rc4_hmac_md5.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/crypto/evp/e_rc4_hmac_md5.c b/crypto/evp/e_rc4_hmac_md5.c
index 28b12c7..832daef 100644
--- a/crypto/evp/e_rc4_hmac_md5.c
+++ b/crypto/evp/e_rc4_hmac_md5.c
@@ -213,6 +213,8 @@ static int rc4_hmac_md5_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
             MD5_Update(&key->tail, hmac_key, sizeof(hmac_key));
+            OPENSSL_cleanse(hmac_key, sizeof(hmac_key));
             return 1;

More information about the openssl-commits mailing list