Turns out OpenSSL's implementation of PBKDF2 allows empty passphrases,

so for compatability with keys that were encrypted with an empty
passphrase we probably want to support it as well.

In PBKDF2, don't reject empty passphrases out of hand; simply call
set_key and if the underlying MAC cannot use the key, throw an
informative exception. This will also be more helpful in the case that
someone tries using another MAC (say, CMAC) with a block cipher that
only supports keys of specific sizes.

In HMAC, allow zero-length keys. This is not really optimal in the
sense of allowing the user to do something dumb, but a 1 byte key
would be pretty dumb as well and we already allowed that.

Add a test vector using an empty passphrase generated by OpenSSL

2 files changed, 11 insertions, 6 deletions

diff --git a/src/mac/hmac/hmac.cpp b/src/mac/hmac/hmac.cpp
index f69504c82..0d5c99702 100644
--- a/src/mac/hmac/hmac.cpp
+++ b/src/mac/hmac/hmac.cpp
@@ -86,7 +86,7 @@ MessageAuthenticationCode* HMAC::clone() const
 */
 HMAC::HMAC(HashFunction* hash_in) :
    MessageAuthenticationCode(hash_in->OUTPUT_LENGTH,
-                             1, 2*hash_in->HASH_BLOCK_SIZE),
+                             0, 2*hash_in->HASH_BLOCK_SIZE),
    hash(hash_in)
    {
    if(hash->HASH_BLOCK_SIZE == 0)
diff --git a/src/pbkdf/pbkdf2/pbkdf2.cpp b/src/pbkdf/pbkdf2/pbkdf2.cpp
index e88a5749a..6f6a514f8 100644
--- a/src/pbkdf/pbkdf2/pbkdf2.cpp
+++ b/src/pbkdf/pbkdf2/pbkdf2.cpp
@@ -22,11 +22,16 @@ OctetString PKCS5_PBKDF2::derive_key(u32bit key_len,
    if(iterations == 0)
       throw Invalid_Argument("PKCS#5 PBKDF2: Invalid iteration count");
 
-   if(passphrase.length() == 0)
-      throw Invalid_Argument("PKCS#5 PBKDF2: Empty passphrase is invalid");
-
-   mac->set_key(reinterpret_cast<const byte*>(passphrase.data()),
-                passphrase.length());
+   try
+      {
+      mac->set_key(reinterpret_cast<const byte*>(passphrase.data()),
+                   passphrase.length());
+      }
+   catch(Invalid_Key_Length)
+      {
+      throw Exception(name() + " cannot accept passphrases of length " +
+                      to_string(passphrase.length()));
+      }
 
    SecureVector<byte> key(key_len);