Skip to content

HMAC 384 and HMAC 512 keys are not supported #112

@LeviSchuck

Description

@LeviSchuck

In pycose/keys/symmetric.py, there are several checks on key length which exclude keys for HS384 and HS512 algorithms.

if key_len not in [16, 24, 32]:

Here's how I reproduce this issue

from pycose.keys import SymmetricKey, keyops
from pycose.algorithms import HMAC256, HMAC384, HMAC512
from binascii import hexlify
hashes = [
    ["HS256", HMAC256],
    ["HS384", HMAC384],
    ["HS512", HMAC512]
]

for [name, alg] in hashes:
    print(f"{alg} - {alg.get_digest_length()}")
    key = SymmetricKey.generate_key(alg.get_digest_length())
    key.kid = b"hello@example.com"
    key.key_ops = [keyops.MacCreateOp, keyops.MacVerifyOp]
    key.alg = alg
    print(hexlify(key.encode()))

This may be corrected by updating said list to

if key_len not in [16, 24, 32, 48, 64]:

Other implementations do support this length, for example in rust: https://github.com/tramires/cose-rust/blob/main/src/algs.rs#L1006

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions