HMAC verification issues

[powersmc]

environment Demo

testSessionId 196472

vsId 676728

Algorithm registration

         {
            "algorithm":"HMAC-SHA-1",
            "revision":"1.0",
            "keyLen":[
               {
                  "min":256,
                  "max":2048,
                  "increment":8
               }
            ],
            "macLen":[
               {
                  "min":96,
                  "max":160,
                  "increment":8
               }
            ]
         },

Endpoint in which the error is experienced POST /acvp/v1/testSessions/196472/vectorSets/676728/results

Expected behavior For this test session and vector set, we submitted results where none of the responses were truncated properly (i.e.: every MAC provided was 160 bits, despite us testing 96-160). As a result, we would've expected many failures when we submitted for verification. The server, however, marked everything as all passing.

One example would be in tgId 1, it states a macLen of 112 Our response file had this MAC, which was 160 bits in length: "2de1bcf626e77c818d079bcf23dac5f026c6381c" When requested, the server says the expected result is: "2DE1BCF626E77C818D079BCF23DA" Upon submittal, the server marked tcId as passing: [{'acvVersion': '1.0'}, {'vsId': 676728, 'disposition': 'passed', 'tests': [{'tcId': 1, 'result': 'passed'},

The expectation would've been that this would be marked as a failure due to the MAC not being the appropriate length.

Additional context N/A

[livebe01]

Thanks for letting us know about this. We'll make sure this gets fixed!

[jbrock24]

Hi @powersmc, sorry for the delay in this, but I am trying to reproduce your error and am unable to do so. Do you have any active knowledge that this is still an issue? I've made changes to HMAC this year, but nothing that I would believe would fix this issue. If not, we can close this until it possibly becomes an issue again, since it's tagged with BUG and by me I should be able to find it, but just can't reproduce this situation, nor do I have access to those run files unfortunately. Thanks!