|
 |
e35e9c |
From bf1e62e59200b2046680d1d3d1599facc88cfe63 Mon Sep 17 00:00:00 2001
|
|
|
e35e9c |
From: Jakub Jelen <jjelen@redhat.com>
|
|
|
e35e9c |
Date: Tue, 29 Nov 2022 14:04:59 +0100
|
|
|
e35e9c |
Subject: [PATCH] rsa: Prevent usage of long salt in FIPS mode
|
|
|
e35e9c |
|
|
|
e35e9c |
* cipher/rsa-common.c (_gcry_rsa_pss_encode): Prevent usage of large
|
|
|
e35e9c |
salt lengths
|
|
|
e35e9c |
(_gcry_rsa_pss_verify): Ditto.
|
|
|
e35e9c |
* tests/basic.c (check_pubkey_sign): Check longer salt length fails in
|
|
|
e35e9c |
FIPS mode
|
|
|
e35e9c |
* tests/t-rsa-pss.c (one_test_sexp): Fix function name in error message
|
|
|
e35e9c |
---
|
|
|
e35e9c |
cipher/rsa-common.c | 14 ++++++++++++++
|
|
|
e35e9c |
tests/basic.c | 19 ++++++++++++++++++-
|
|
|
e35e9c |
tests/t-rsa-pss.c | 2 +-
|
|
|
e35e9c |
3 files changed, 33 insertions(+), 2 deletions(-)
|
|
|
e35e9c |
|
|
|
e35e9c |
diff --git a/cipher/rsa-common.c b/cipher/rsa-common.c
|
|
|
e35e9c |
index 233ddb2d..61cd60a4 100644
|
|
|
e35e9c |
--- a/cipher/rsa-common.c
|
|
|
e35e9c |
+++ b/cipher/rsa-common.c
|
|
|
e35e9c |
@@ -809,6 +809,13 @@ _gcry_rsa_pss_encode (gcry_mpi_t *r_result, unsigned int nbits, int algo,
|
|
|
e35e9c |
hlen = _gcry_md_get_algo_dlen (algo);
|
|
|
e35e9c |
gcry_assert (hlen); /* We expect a valid ALGO here. */
|
|
|
e35e9c |
|
|
|
e35e9c |
+ /* The FIPS 186-4 Section 5.5 allows only 0 <= sLen <= hLen */
|
|
|
e35e9c |
+ if (fips_mode () && saltlen > hlen)
|
|
|
e35e9c |
+ {
|
|
|
e35e9c |
+ rc = GPG_ERR_INV_ARG;
|
|
|
e35e9c |
+ goto leave;
|
|
|
e35e9c |
+ }
|
|
|
e35e9c |
+
|
|
|
e35e9c |
/* Allocate a help buffer and setup some pointers. */
|
|
|
e35e9c |
buflen = 8 + hlen + saltlen + (emlen - hlen - 1);
|
|
|
e35e9c |
buf = xtrymalloc (buflen);
|
|
|
e35e9c |
@@ -950,6 +957,13 @@ _gcry_rsa_pss_verify (gcry_mpi_t value, int hashed_already,
|
|
|
e35e9c |
hlen = _gcry_md_get_algo_dlen (algo);
|
|
|
e35e9c |
gcry_assert (hlen); /* We expect a valid ALGO here. */
|
|
|
e35e9c |
|
|
|
e35e9c |
+ /* The FIPS 186-4 Section 5.5 allows only 0 <= sLen <= hLen */
|
|
|
e35e9c |
+ if (fips_mode () && saltlen > hlen)
|
|
|
e35e9c |
+ {
|
|
|
e35e9c |
+ rc = GPG_ERR_INV_ARG;
|
|
|
e35e9c |
+ goto leave;
|
|
|
e35e9c |
+ }
|
|
|
e35e9c |
+
|
|
|
e35e9c |
/* Allocate a help buffer and setup some pointers.
|
|
|
e35e9c |
This buffer is used for two purposes:
|
|
|
e35e9c |
+------------------------------+-------+
|
|
|
e35e9c |
diff --git a/tests/basic.c b/tests/basic.c
|
|
|
e35e9c |
index 77e2fd93..429bd237 100644
|
|
|
e35e9c |
--- a/tests/basic.c
|
|
|
e35e9c |
+++ b/tests/basic.c
|
|
|
e35e9c |
@@ -16602,6 +16602,7 @@ check_pubkey_sign (int n, gcry_sexp_t skey, gcry_sexp_t pkey, int algo,
|
|
|
e35e9c |
const char *data;
|
|
|
e35e9c |
int algo;
|
|
|
e35e9c |
int expected_rc;
|
|
|
e35e9c |
+ int flags;
|
|
|
e35e9c |
} datas[] =
|
|
|
e35e9c |
{
|
|
|
e35e9c |
{ "(data\n (flags pkcs1)\n"
|
|
|
e35e9c |
@@ -16672,6 +16673,22 @@ check_pubkey_sign (int n, gcry_sexp_t skey, gcry_sexp_t pkey, int algo,
|
|
|
e35e9c |
" (random-override #4253647587980912233445566778899019283747#))\n",
|
|
|
e35e9c |
GCRY_PK_RSA,
|
|
|
e35e9c |
0 },
|
|
|
e35e9c |
+ { "(data\n (flags pss)\n"
|
|
|
e35e9c |
+ " (hash-algo sha256)\n"
|
|
|
e35e9c |
+ " (value #11223344556677889900AABBCCDDEEFF#)\n"
|
|
|
e35e9c |
+ " (salt-length 2:32)\n"
|
|
|
e35e9c |
+ " (random-override #42536475879809122334455667788990192837465564738291"
|
|
|
e35e9c |
+ "00122334455667#))\n",
|
|
|
e35e9c |
+ GCRY_PK_RSA,
|
|
|
e35e9c |
+ 0 },
|
|
|
e35e9c |
+ { "(data\n (flags pss)\n"
|
|
|
e35e9c |
+ " (hash-algo sha256)\n"
|
|
|
e35e9c |
+ " (value #11223344556677889900AABBCCDDEEFF#)\n"
|
|
|
e35e9c |
+ " (salt-length 2:33)\n"
|
|
|
e35e9c |
+ " (random-override #42536475879809122334455667788990192837465564738291"
|
|
|
e35e9c |
+ "0012233445566778#))\n",
|
|
|
e35e9c |
+ GCRY_PK_RSA,
|
|
|
e35e9c |
+ 0, FLAG_NOFIPS },
|
|
|
e35e9c |
{ NULL }
|
|
|
e35e9c |
};
|
|
|
e35e9c |
|
|
|
e35e9c |
@@ -16695,7 +16712,7 @@ check_pubkey_sign (int n, gcry_sexp_t skey, gcry_sexp_t pkey, int algo,
|
|
|
e35e9c |
die ("converting data failed: %s\n", gpg_strerror (rc));
|
|
|
e35e9c |
|
|
|
e35e9c |
rc = gcry_pk_sign (&sig, hash, skey);
|
|
|
e35e9c |
- if (in_fips_mode && (flags & FLAG_NOFIPS))
|
|
|
e35e9c |
+ if (in_fips_mode && (flags & FLAG_NOFIPS || datas[dataidx].flags & FLAG_NOFIPS))
|
|
|
e35e9c |
{
|
|
|
e35e9c |
if (!rc)
|
|
|
e35e9c |
fail ("gcry_pk_sign did not fail as expected in FIPS mode\n");
|
|
|
e35e9c |
diff --git a/tests/t-rsa-pss.c b/tests/t-rsa-pss.c
|
|
|
e35e9c |
index c5f90116..82dd54b3 100644
|
|
|
e35e9c |
--- a/tests/t-rsa-pss.c
|
|
|
e35e9c |
+++ b/tests/t-rsa-pss.c
|
|
|
e35e9c |
@@ -340,7 +340,7 @@ one_test_sexp (const char *n, const char *e, const char *d,
|
|
|
e35e9c |
snprintf (p, 3, "%02x", out[i]);
|
|
|
e35e9c |
if (strcmp (sig_string, s))
|
|
|
e35e9c |
{
|
|
|
e35e9c |
- fail ("gcry_pkhash_sign failed: %s",
|
|
|
e35e9c |
+ fail ("gcry_pk_hash_sign failed: %s",
|
|
|
e35e9c |
"wrong value returned");
|
|
|
e35e9c |
info (" expected: '%s'", s);
|
|
|
e35e9c |
info (" got: '%s'", sig_string);
|
|
|
e35e9c |
--
|
|
|
e35e9c |
2.39.0
|
|
|
e35e9c |
|