Created attachment 1920262 [details]
PBKDF2 reproducer for OpenSSL 3

Description of problem:
In FIPS mode, OpenSSL accepts arbitrarily short passwords in PBKDF2. It should reject short passwords.

When invoked with short passwords, OpenSSL should either set an explicit indicator, or fail the call (i.e., have an implicit indicator).

Version-Release number of selected component (if applicable):
3.0.1-41.el9_0

How reproducible:
Run the attached reproducer with a short password.

Steps to Reproduce:
1. cc -std=c99 -Wall -Werror -pedantic -D_XOPEN_SOURCE=600 -o pbkdf2 pbkdf2.c -lcrypto
2. ./pbkdf2 sha256 16 1000 14 ""

Actual results:
OK: 0x9e3cbde11511443b1d66bd614ac0

Expected results:
ERR Failed to set EVP_KDF_CTX parameters: error:1C800070:Provider routines::invalid password length (in function kdf_pbkdf2_set_ctx_params in providers/implementations/kdfs/pbkdf2.c:196)

Additional info:
Similar checks already exist for short salt lengths and short output password lengths. See the error message in "Expected results", which was modified from a short salt length. Also see the documentation for OSSL_KDF_PARAM_PKCS5 in https://www.openssl.org/docs/man3.0/man7/EVP_KDF-PBKDF2.html, which already refers to checks that are done in FIPS mode but not outside of FIPS mode by default. We should probably just extend those tests.

As reasonable limit for the password length is probably >= 8 bytes. Do not choose a minimum password length of more than 8 bytes combined with an implicit indicator, since ACVP testing expects 8-byte passwords to work.