Pass the right length of null bytes when no salt is provided to HKDF (#4036)
This bug looks bad but ends up being benign because HMAC is specified to
pad null bytes if a key is too short. So we passed too few bytes and
then OpenSSL obligingly padded it out to the correct length. However, we
should still do the right thing obviously.
diff --git a/src/cryptography/hazmat/primitives/kdf/hkdf.py b/src/cryptography/hazmat/primitives/kdf/hkdf.py
index 82ed9b1..964ac2c 100644
--- a/src/cryptography/hazmat/primitives/kdf/hkdf.py
+++ b/src/cryptography/hazmat/primitives/kdf/hkdf.py
@@ -30,7 +30,7 @@
raise TypeError("salt must be bytes.")
if salt is None:
- salt = b"\x00" * (self._algorithm.digest_size // 8)
+ salt = b"\x00" * self._algorithm.digest_size
self._salt = salt