From c93f4a1e75efbb10153b2520a10e5a19a4479fdf Mon Sep 17 00:00:00 2001 From: =?utf8?q?=D0=97=D0=B8=D1=88=D0=B0=D0=BD=20=D0=9C=D0=B8=D1=80=D0=B7?= =?utf8?q?=D0=B0?= Date: Tue, 24 Dec 2024 11:05:21 +0500 Subject: [PATCH] ec_kem.c: Fix ikmlen check This makes `ikmlen` have a length of at least `Nsk`. Closes #26213 Reviewed-by: Matt Caswell Reviewed-by: Dmitry Belyavskiy Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26254) --- providers/implementations/kem/ec_kem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/providers/implementations/kem/ec_kem.c b/providers/implementations/kem/ec_kem.c index 9d8f94270eb..c58727c9e2f 100644 --- a/providers/implementations/kem/ec_kem.c +++ b/providers/implementations/kem/ec_kem.c @@ -405,10 +405,10 @@ int ossl_ec_dhkem_derive_private(EC_KEY *ec, BIGNUM *priv, return 0; /* ikmlen should have a length of at least Nsk */ - if (ikmlen < info->Nsecret) { + if (ikmlen < info->Nsk) { ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_INPUT_LENGTH, "ikm length is :%zu, should be at least %zu", - ikmlen, info->Nsecret); + ikmlen, info->Nsk); goto err; } -- 2.47.2