From b12ac0a1214503458862af0070305176a140439f Mon Sep 17 00:00:00 2001
From: jsing <>
Date: Fri, 13 Jun 2014 16:09:15 +0000
Subject: Correctly calculate the key block length when using export ciphers.

---
 src/lib/libssl/src/ssl/t1_enc.c | 6 +++++-
 src/lib/libssl/t1_enc.c         | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libssl/src/ssl/t1_enc.c b/src/lib/libssl/src/ssl/t1_enc.c
index 7b6c9b7ac6..fe8ccab23e 100644
--- a/src/lib/libssl/src/ssl/t1_enc.c
+++ b/src/lib/libssl/src/ssl/t1_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_enc.c,v 1.58 2014/06/13 14:32:35 jsing Exp $ */
+/* $OpenBSD: t1_enc.c,v 1.59 2014/06/13 16:09:15 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -697,6 +697,10 @@ tls1_setup_key_block(SSL *s)
 		key_len = EVP_CIPHER_key_length(cipher);
 		iv_len = EVP_CIPHER_iv_length(cipher);
 
+		if (SSL_C_IS_EXPORT(s->session->cipher) &&
+                    key_len > SSL_C_EXPORT_KEYLENGTH(s->session->cipher))
+                        key_len = SSL_C_EXPORT_KEYLENGTH(s->session->cipher);
+
 		/* If GCM mode only part of IV comes from PRF. */ 
 		if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE)
 			iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index 7b6c9b7ac6..fe8ccab23e 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_enc.c,v 1.58 2014/06/13 14:32:35 jsing Exp $ */
+/* $OpenBSD: t1_enc.c,v 1.59 2014/06/13 16:09:15 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -697,6 +697,10 @@ tls1_setup_key_block(SSL *s)
 		key_len = EVP_CIPHER_key_length(cipher);
 		iv_len = EVP_CIPHER_iv_length(cipher);
 
+		if (SSL_C_IS_EXPORT(s->session->cipher) &&
+                    key_len > SSL_C_EXPORT_KEYLENGTH(s->session->cipher))
+                        key_len = SSL_C_EXPORT_KEYLENGTH(s->session->cipher);
+
 		/* If GCM mode only part of IV comes from PRF. */ 
 		if (EVP_CIPHER_mode(cipher) == EVP_CIPH_GCM_MODE)
 			iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
-- 
cgit v1.2.3-55-g6feb