Add a runtime check for label length
RFC8446 says that key derivation labels must be less than 12 octets.
This avoids incurring extra hash compression rounds.
This change adds a runtime check to ensure that all labels used
meet this requirement.
@@ -93,6 +93,11 @@ int s2n_hkdf_expand_label(struct s2n_hmac_state *hmac, s2n_hmac_algorithm alg, c
struct s2n_blob hkdf_label_blob = {0};
struct s2n_stuffer hkdf_label = {{0}};
+ /* RFC8446 specifies that labels must be 12 characters or less, to avoid
+ ** incurring two hash rounds.
+ */
+ lte_check(label->size, 12);
+
GUARD(s2n_blob_init(&hkdf_label_blob, hkdf_label_buf, sizeof(hkdf_label_buf)));
GUARD(s2n_stuffer_init(&hkdf_label, &hkdf_label_blob));
GUARD(s2n_stuffer_write_uint16(&hkdf_label, output->size));
