findthebug.c

void compute_session_keys(uint8_t encryptkey[AES128_KEY_LEN],
                uint8_t master_key[AES128_KEY_LEN],
                uint8_t encryption_salt[8]){
 
        uint8_t long_encryptkey[SHA256_DIGEST_LEN];
        HMAC_SHA256_CTX ctx;
 
        HMAC_SHA256_Init(&ctx, master_key, sizeof(master_key));
        HMAC_SHA256_Update(&ctx,encryption_salt, 8);
        HMAC_SHA256_Update(&ctx, "encryption", 10);
        HMAC_SHA256_Final(long_encryptkey, &ctx);
  
        memcpy(encryptkey, long_encryptkey, AES128_KEY_LEN);
        ZERO(long_encryptkey);
        ZERO(ctx);
}
 
void compute_session_keys_password (char *password, int iterations,
                uint8_t encryptkey[16],
                uint8_t encryption_salt[8],
                uint8_t password_salt[8]
                ){
 
        uint8_t master_key[AES128_KEY_LEN];
        /* compute the password hash */
        PBKDF2_SHA256((uint8_t *)password, strlen(password), password_salt, 8, iterations,
                        master_key, sizeof(master_key));
#ifdef CRYPTO_DEBUG
        print_key("masterkey", master_key, sizeof(master_key));
#endif
        compute_session_keys(encryptkey, master_key, encryption_salt);
        ZERO(master_key);
}