From 9f5a60c1fe576f82bcd5c7998b2ca2b0d60e8e4f Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 27 Jan 2022 18:17:43 +0100 Subject: [PATCH 1/2] rsa_generate_fips186_4_keypair: accept a few more modulus sizes While _rsa_generate_fips186_4_keypair was modified to accept modulus sizes other than 2048 and 3076, rsa_generate_fips186_4_keypair, which calls that function, was not updated to accept such modulus sizes. Spotted by Alexander Sosedkin. Signed-off-by: Daiki Ueno --- lib/nettle/int/rsa-keygen-fips186.c | 67 ++++++++++++++++------------- 1 file changed, 36 insertions(+), 31 deletions(-) diff --git a/lib/nettle/int/rsa-keygen-fips186.c b/lib/nettle/int/rsa-keygen-fips186.c index 5b221a030a..c6f7e675af 100644 --- a/lib/nettle/int/rsa-keygen-fips186.c +++ b/lib/nettle/int/rsa-keygen-fips186.c @@ -27,6 +27,7 @@ #include "config.h" #endif +#include #include #include #include @@ -248,6 +249,33 @@ cleanup: return ret; } +/* Return the pre-defined seed length for modulus size, or 0 when the + * modulus size is unsupported. + */ +static inline unsigned +seed_length_for_modulus_size(unsigned modulus_size) +{ + switch (modulus_size) { + case 2048: /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */ + return 14 * 2; + case 3072: /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */ + return 16 * 2; + case 4096: /* SP 800-56B rev 2 Appendix D */ + return 19 * 2; + case 6144: /* SP 800-56B rev 2 Appendix D */ + return 22 * 2; + case 7680: /* FIPS 140-2 IG 7.5 */ + return 24 * 2; + case 8192: /* SP 800-56B rev 2 Appendix D */ + return 25 * 2; + case 15360: /* FIPS 140-2 IG 7.5 */ + return 32 * 2; + default: + return 0; + } + +} + /* This generates p,q params using the B.3.2.2 algorithm in FIPS 186-4. * * The hash function used is SHA384. @@ -266,33 +294,15 @@ _rsa_generate_fips186_4_keypair(struct rsa_public_key *pub, int ret; struct dss_params_validation_seeds cert; unsigned l = n_size / 2; + unsigned s = seed_length_for_modulus_size(n_size); - switch (n_size) { - case 2048: /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */ - FIPS_RULE(seed_length != 14 * 2, 0, "seed length other than 28 bytes\n"); - break; - case 3072: /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */ - FIPS_RULE(seed_length != 16 * 2, 0, "seed length other than 32 bytes\n"); - break; - case 4096: /* SP 800-56B rev 2 Appendix D */ - FIPS_RULE(seed_length != 19 * 2, 0, "seed length other than 38 bytes\n"); - break; - case 6144: /* SP 800-56B rev 2 Appendix D */ - FIPS_RULE(seed_length != 22 * 2, 0, "seed length other than 44 bytes\n"); - break; - case 7680: /* FIPS 140-2 IG 7.5 */ - FIPS_RULE(seed_length != 24 * 2, 0, "seed length other than 48 bytes\n"); - break; - case 8192: /* SP 800-56B rev 2 Appendix D */ - FIPS_RULE(seed_length != 25 * 2, 0, "seed length other than 50 bytes\n"); - break; - case 15360: /* FIPS 140-2 IG 7.5 */ - FIPS_RULE(seed_length != 32 * 2, 0, "seed length other than 64 bytes\n"); - break; - default: + if (!s) { FIPS_RULE(false, 0, "unsupported modulus size\n"); } + FIPS_RULE(seed_length != s, 0, + "seed length other than %u bytes\n", s); + if (!mpz_tstbit(pub->e, 0)) { _gnutls_debug_log("Unacceptable e (it is even)\n"); return 0; @@ -405,10 +415,6 @@ _rsa_generate_fips186_4_keypair(struct rsa_public_key *pub, return ret; } -/* Not entirely accurate but a good precision - */ -#define SEED_LENGTH(bits) (_gnutls_pk_bits_to_subgroup_bits(bits)/8) - /* This generates p,q params using the B.3.2.2 algorithm in FIPS 186-4. * * The hash function used is SHA384. @@ -429,11 +435,10 @@ rsa_generate_fips186_4_keypair(struct rsa_public_key *pub, unsigned seed_length; int ret; - FIPS_RULE(n_size != 2048 && n_size != 3072, 0, "size of prime of other than 2048 or 3072\n"); + seed_length = seed_length_for_modulus_size(n_size); + FIPS_RULE(!seed_length, 0, "unsupported modulus size\n"); - seed_length = SEED_LENGTH(n_size); - if (seed_length > sizeof(seed)) - return 0; + assert(seed_length <= sizeof(seed)); random(random_ctx, seed_length, seed); -- 2.34.1 From 46ae6160489151034bca19aa6c40ba0df6b53bcc Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 1 Feb 2022 15:19:52 +0100 Subject: [PATCH 2/2] certtool --generate-privkey: update warnings on RSA key sizes Signed-off-by: Daiki Ueno --- src/certtool.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/src/certtool.c b/src/certtool.c index c128500614..71d4aff13e 100644 --- a/src/certtool.c +++ b/src/certtool.c @@ -206,8 +206,12 @@ generate_private_key_int(common_info_st * cinfo) "Note that DSA keys with size over 1024 may cause incompatibility problems when used with earlier than TLS 1.2 versions.\n\n"); if ((HAVE_OPT(SEED) || provable) && GNUTLS_PK_IS_RSA(key_type)) { - if (bits != 2048 && bits != 3072) { - fprintf(stderr, "Note that the FIPS 186-4 key generation restricts keys to 2048 and 3072 bits\n"); + /* Keep in sync with seed_length_for_modulus_size in + * lib/nettle/int/rsa-keygen-fips186.c. */ + if (bits != 2048 && bits != 3072 && bits != 4096 && + bits != 6144 && bits != 7680 && bits != 8192 && + bits != 15360) { + fprintf(stderr, "Note that the FIPS 186-4 key generation restricts keys to be of known lengths (2048, 3072, etc)\n"); } } @@ -225,7 +229,15 @@ generate_private_key_int(common_info_st * cinfo) kdata[kdata_size++].size = cinfo->seed_size; if (GNUTLS_PK_IS_RSA(key_type)) { - if ((bits == 3072 && cinfo->seed_size != 32) || (bits == 2048 && cinfo->seed_size != 28)) { + /* Keep in sync with seed_length_for_modulus_size in + * lib/nettle/int/rsa-keygen-fips186.c. */ + if ((bits == 2048 && cinfo->seed_size != 28) || + (bits == 3072 && cinfo->seed_size != 32) || + (bits == 4096 && cinfo->seed_size != 38) || + (bits == 6144 && cinfo->seed_size != 44) || + (bits == 7680 && cinfo->seed_size != 48) || + (bits == 8192 && cinfo->seed_size != 50) || + (bits == 15360 && cinfo->seed_size != 64)) { fprintf(stderr, "The seed size (%d) doesn't match the size of the request security level; use -d 2 for more information.\n", (int)cinfo->seed_size); } } else if (key_type == GNUTLS_PK_DSA) { -- 2.34.1