Merge "Fixed HMAC bug. Public object MACs were incorrectly generated."

object_store_impl.cc

diff --git a/object_store_impl.cc b/object_store_impl.cc
index 4b81709..00821ce 100644
--- a/object_store_impl.cc
+++ b/object_store_impl.cc
@@ -210,7 +210,7 @@
   return RunCipher(true,
                    key,
                    string(),
-                   AppendHMAC(plain_text.blob),
+                   AppendHMAC(plain_text.blob, key),
                    &cipher_text->blob);
 }
 
@@ -227,16 +227,17 @@
   if (!RunCipher(false, key, string(), cipher_text.blob, &plain_text_with_hmac))
     return false;
   // Check the MAC that was appended before encrypting.
-  if (!VerifyAndStripHMAC(plain_text_with_hmac, &plain_text->blob))
+  if (!VerifyAndStripHMAC(plain_text_with_hmac, key, &plain_text->blob))
     return false;
   return true;
 }
 
-string ObjectStoreImpl::AppendHMAC(const string& input) {
-  return input + HmacSha512(input, key_);
+string ObjectStoreImpl::AppendHMAC(const string& input, const string& key) {
+  return input + HmacSha512(input, key);
 }
 
 bool ObjectStoreImpl::VerifyAndStripHMAC(const string& input,
+                                         const string& key,
                                          string* stripped) {
   if (input.size() < static_cast<size_t>(kHMACSizeBytes)) {
     LOG(ERROR) << "Failed to verify blob integrity.";
@@ -244,7 +245,7 @@
   }
   *stripped = input.substr(0, input.size() - kHMACSizeBytes);
   string hmac = input.substr(input.size() - kHMACSizeBytes);
-  if (hmac != HmacSha512(*stripped, key_)) {
+  if (hmac != HmacSha512(*stripped, key)) {
     LOG(ERROR) << "Failed to verify blob integrity.";
     return false;
   }

object_store_impl.h

diff --git a/object_store_impl.h b/object_store_impl.h
index f1de4e6..df8e0b2 100644
--- a/object_store_impl.h
+++ b/object_store_impl.h
@@ -59,10 +59,12 @@
                ObjectBlob* plain_text);
 
   // Computes an HMAC and appends it to the given input.
-  std::string AppendHMAC(const std::string& input);
+  std::string AppendHMAC(const std::string& input, const std::string& key);
 
   // Verifies an appended HMAC and strips it from the given input.
-  bool VerifyAndStripHMAC(const std::string& input, std::string* stripped);
+  bool VerifyAndStripHMAC(const std::string& input,
+                          const std::string& key,
+                          std::string* stripped);
 
   // Creates and returns a unique database key for a blob.
   std::string CreateBlobKey(BlobType type, int blob_id);