diff options
author | Dr. Stephen Henson <steve@openssl.org> | 2016-07-19 18:40:14 +0100 |
---|---|---|
committer | Dr. Stephen Henson <steve@openssl.org> | 2016-07-22 14:02:38 +0100 |
commit | bd19d1aa04d14233c037386a2c969b0164c2cc37 (patch) | |
tree | e91ec6b5b74b864b211c0ec02e8a03220fc48dcb | |
parent | 3770b877ea7b7fa08e88395e8c472c102f9e707e (diff) | |
download | openssl-bd19d1aa04d14233c037386a2c969b0164c2cc37.tar.gz |
Clarify digest change in HMAC_Init_ex()
RT#4603
Reviewed-by: Rich Salz <rsalz@openssl.org>
-rw-r--r-- | doc/crypto/HMAC.pod | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/doc/crypto/HMAC.pod b/doc/crypto/HMAC.pod index fdafec86b9..91d0bdc3d5 100644 --- a/doc/crypto/HMAC.pod +++ b/doc/crypto/HMAC.pod @@ -79,13 +79,17 @@ function B<evp_md> and the key B<key> which is B<key_len> bytes long. It is deprecated and only included for backward compatibility with OpenSSL 0.9.6b. -HMAC_Init_ex() initializes or reuses a B<HMAC_CTX> structure to use -the function B<evp_md> and key B<key>. Either can be NULL, in which -case the existing one will be reused. B<ctx> must have been created -with HMAC_CTX_new() before the first use of an B<HMAC_CTX> in this -function. B<N.B. HMAC_Init() had this undocumented behaviour in -previous versions of OpenSSL - failure to switch to HMAC_Init_ex() in -programs that expect it will cause them to stop working>. +HMAC_Init_ex() initializes or reuses a B<HMAC_CTX> structure to use the hash +function B<evp_md> and key B<key>. If both are NULL (or B<evp_md> is the same +as the previous digest used by B<ctx> and B<key> is NULL) the existing key is +reused. B<ctx> must have been created with HMAC_CTX_new() before the first use +of an B<HMAC_CTX> in this function. B<N.B. HMAC_Init() had this undocumented +behaviour in previous versions of OpenSSL - failure to switch to HMAC_Init_ex() +in programs that expect it will cause them to stop working>. + +B<NB: if HMAC_Init_ex() is called with B<key> NULL and B<evp_md> is not the +same as the previous digest used by B<ctx> then an error is returned +because reuse of an existing key with a different digest is not supported.> HMAC_Update() can be called repeatedly with chunks of the message to be authenticated (B<len> bytes at B<data>). |