diff --git a/crypto/s2n_hmac.c b/crypto/s2n_hmac.c index 3b519c1f72a..48842259671 100644 --- a/crypto/s2n_hmac.c +++ b/crypto/s2n_hmac.c @@ -75,28 +75,6 @@ int s2n_hmac_digest_size(s2n_hmac_algorithm hmac_alg, uint8_t *out) return S2N_SUCCESS; } -/* Return 1 if hmac algorithm is available, 0 otherwise. */ -bool s2n_hmac_is_available(s2n_hmac_algorithm hmac_alg) -{ - switch(hmac_alg) { - case S2N_HMAC_MD5: - case S2N_HMAC_SSLv3_MD5: - /* Some libcryptos, such as OpenSSL, disable MD5 by default when in FIPS mode, which is - * required in order to negotiate SSLv3. However, this is supported in AWS-LC. - */ - return !s2n_is_in_fips_mode() || s2n_libcrypto_is_awslc(); - case S2N_HMAC_SSLv3_SHA1: - case S2N_HMAC_NONE: - case S2N_HMAC_SHA1: - case S2N_HMAC_SHA224: - case S2N_HMAC_SHA256: - case S2N_HMAC_SHA384: - case S2N_HMAC_SHA512: - return true; - } - return false; -} - static int s2n_sslv3_mac_init(struct s2n_hmac_state *state, s2n_hmac_algorithm alg, const void *key, uint32_t klen) { for (int i = 0; i < state->xor_pad_size; i++) { @@ -205,10 +183,6 @@ S2N_RESULT s2n_hmac_state_validate(struct s2n_hmac_state *state) int s2n_hmac_init(struct s2n_hmac_state *state, s2n_hmac_algorithm alg, const void *key, uint32_t klen) { POSIX_ENSURE_REF(state); - if (!s2n_hmac_is_available(alg)) { - /* Prevent hmacs from being used if they are not available. */ - POSIX_BAIL(S2N_ERR_HMAC_INVALID_ALGORITHM); - } state->alg = alg; POSIX_GUARD(s2n_hmac_hash_block_size(alg, &state->hash_block_size)); diff --git a/crypto/s2n_hmac.h b/crypto/s2n_hmac.h index 81b96c06ea6..de1379d83ec 100644 --- a/crypto/s2n_hmac.h +++ b/crypto/s2n_hmac.h @@ -61,7 +61,6 @@ struct s2n_hmac_evp_backup { }; int s2n_hmac_digest_size(s2n_hmac_algorithm alg, uint8_t *out); -bool s2n_hmac_is_available(s2n_hmac_algorithm alg); int s2n_hmac_hash_alg(s2n_hmac_algorithm hmac_alg, s2n_hash_algorithm *out); int s2n_hash_hmac_alg(s2n_hash_algorithm hash_alg, s2n_hmac_algorithm *out); diff --git a/tests/cbmc/proofs/s2n_hmac_is_available/Makefile b/tests/cbmc/proofs/s2n_hmac_is_available/Makefile deleted file mode 100644 index 0cd6a1a078b..00000000000 --- a/tests/cbmc/proofs/s2n_hmac_is_available/Makefile +++ /dev/null @@ -1,31 +0,0 @@ -# -# -# Licensed under the Apache License, Version 2.0 (the "License"). You may not use -# this file except in compliance with the License. A copy of the License is -# located at -# -# http://aws.amazon.com/apache2.0/ -# -# or in the "license" file accompanying this file. This file is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or -# implied. See the License for the specific language governing permissions and -# limitations under the License. - -# Expected runtime is less than 5 seconds. - -CBMCFLAGS += - -PROOF_UID = s2n_hmac_is_available -HARNESS_ENTRY = $(PROOF_UID)_harness -HARNESS_FILE = $(HARNESS_ENTRY).c - -PROOF_SOURCES += $(PROOFDIR)/$(HARNESS_FILE) -PROOF_SOURCES += $(PROOF_STUB)/s2n_calculate_stacktrace.c -PROOF_SOURCES += $(PROOF_STUB)/s2n_is_in_fips_mode.c -PROOF_SOURCES += $(PROOF_STUB)/s2n_libcrypto_is_awslc.c - -PROJECT_SOURCES += $(SRCDIR)/crypto/s2n_hmac.c - -UNWINDSET += - -include ../Makefile.common diff --git a/tests/cbmc/proofs/s2n_hmac_is_available/cbmc-proof.txt b/tests/cbmc/proofs/s2n_hmac_is_available/cbmc-proof.txt deleted file mode 100644 index 6ed46f1258c..00000000000 --- a/tests/cbmc/proofs/s2n_hmac_is_available/cbmc-proof.txt +++ /dev/null @@ -1 +0,0 @@ -# This file marks this directory as containing a CBMC proof. diff --git a/tests/cbmc/proofs/s2n_hmac_is_available/s2n_hmac_is_available_harness.c b/tests/cbmc/proofs/s2n_hmac_is_available/s2n_hmac_is_available_harness.c deleted file mode 100644 index 9c9fba4ec5a..00000000000 --- a/tests/cbmc/proofs/s2n_hmac_is_available/s2n_hmac_is_available_harness.c +++ /dev/null @@ -1,48 +0,0 @@ -/* - * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. - * - * Licensed under the Apache License, Version 2.0 (the "License"). - * You may not use this file except in compliance with the License. - * A copy of the License is located at - * - * http://aws.amazon.com/apache2.0 - * - * or in the "license" file accompanying this file. This file is distributed - * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either - * express or implied. See the License for the specific language governing - * permissions and limitations under the License. - */ - -#include - -#include "crypto/s2n_fips.h" -#include "crypto/s2n_hmac.h" -#include "crypto/s2n_openssl.h" - -#include - -void s2n_hmac_is_available_harness() -{ - /* Non-deterministic inputs. */ - s2n_hmac_algorithm hmac_alg; - - /* Operation under verification. */ - bool is_available = s2n_hmac_is_available(hmac_alg); - - /* Postconditions. */ - switch (hmac_alg) { - case S2N_HASH_MD5: - case S2N_HMAC_SSLv3_MD5: - assert(is_available == !s2n_is_in_fips_mode() || s2n_libcrypto_is_awslc()); break; - case S2N_HMAC_SSLv3_SHA1: - case S2N_HASH_NONE: - case S2N_HASH_SHA1: - case S2N_HASH_SHA224: - case S2N_HASH_SHA256: - case S2N_HASH_SHA384: - case S2N_HASH_SHA512: - assert(is_available); break; - default: - __CPROVER_assert(!is_available, "Unsupported algorithm."); - } -} diff --git a/tests/unit/s2n_hmac_test.c b/tests/unit/s2n_hmac_test.c index 74fe6fc9033..11020d3c909 100644 --- a/tests/unit/s2n_hmac_test.c +++ b/tests/unit/s2n_hmac_test.c @@ -47,8 +47,8 @@ int main(int argc, char **argv) EXPECT_SUCCESS(s2n_hmac_new(©)); EXPECT_SUCCESS(s2n_hmac_new(&cmac)); - if (s2n_hmac_is_available(S2N_HMAC_SSLv3_MD5)) { - /* Try SSLv3 MD5 */ + /* Try SSLv3 MD5 */ + { uint8_t hmac_sslv3_md5_size = 0; POSIX_GUARD(s2n_hmac_digest_size(S2N_HMAC_SSLv3_MD5, &hmac_sslv3_md5_size)); EXPECT_EQUAL(hmac_sslv3_md5_size, 16); @@ -80,8 +80,8 @@ int main(int argc, char **argv) EXPECT_SUCCESS(s2n_hmac_reset(&hmac)); } - if (s2n_hmac_is_available(S2N_HMAC_SSLv3_SHA1)) { - /* Try SSLv3 SHA1 */ + /* Try SSLv3 SHA1 */ + { uint8_t hmac_sslv3_sha1_size = 0; POSIX_GUARD(s2n_hmac_digest_size(S2N_HMAC_SSLv3_SHA1, &hmac_sslv3_sha1_size)); EXPECT_EQUAL(hmac_sslv3_sha1_size, 20); @@ -113,8 +113,8 @@ int main(int argc, char **argv) EXPECT_SUCCESS(s2n_hmac_reset(&hmac)); } - if (s2n_hmac_is_available(S2N_HMAC_MD5)) { - /* Try MD5 */ + /* Try MD5 */ + { uint8_t hmac_md5_size = 0; POSIX_GUARD(s2n_hmac_digest_size(S2N_HMAC_MD5, &hmac_md5_size)); EXPECT_EQUAL(hmac_md5_size, 16);