diff options
author | Mark J. Cox <mark@openssl.org> | 2006-09-05 08:58:03 +0000 |
---|---|---|
committer | Mark J. Cox <mark@openssl.org> | 2006-09-05 08:58:03 +0000 |
commit | b79aa05e3babdbab92c6356f6e51f7bb43c41576 (patch) | |
tree | 1963310ff2983ec5cba1330c9a58b343f6e0b232 /crypto/rsa | |
parent | 500b5a181df0e8e442e4cbf954213ff886b29df3 (diff) |
Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
(CVE-2006-4339)
Submitted by: Ben Laurie, Google Security Team
Reviewed by: bmoeller, mjc, shenson
Diffstat (limited to 'crypto/rsa')
-rw-r--r-- | crypto/rsa/rsa.h | 1 | ||||
-rw-r--r-- | crypto/rsa/rsa_eay.c | 9 | ||||
-rw-r--r-- | crypto/rsa/rsa_err.c | 1 | ||||
-rw-r--r-- | crypto/rsa/rsa_sign.c | 17 |
4 files changed, 28 insertions, 0 deletions
diff --git a/crypto/rsa/rsa.h b/crypto/rsa/rsa.h index 31f3792a4c..c8b6a814a0 100644 --- a/crypto/rsa/rsa.h +++ b/crypto/rsa/rsa.h @@ -457,6 +457,7 @@ void ERR_load_RSA_strings(void); #define RSA_R_N_DOES_NOT_EQUAL_P_Q 127 #define RSA_R_OAEP_DECODING_ERROR 121 #define RSA_R_PADDING_CHECK_FAILED 114 +#define RSA_R_PKCS1_PADDING_TOO_SHORT 105 #define RSA_R_P_NOT_PRIME 128 #define RSA_R_Q_NOT_PRIME 129 #define RSA_R_RSA_OPERATIONS_NOT_SUPPORTED 130 diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c index c6ceaee6e7..863a45a975 100644 --- a/crypto/rsa/rsa_eay.c +++ b/crypto/rsa/rsa_eay.c @@ -640,6 +640,15 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from, { case RSA_PKCS1_PADDING: r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num); + /* Generally signatures should be at least 2/3 padding, though + this isn't possible for really short keys and some standard + signature schemes, so don't check if the unpadded data is + small. */ + if(r > 42 && 3*8*r >= BN_num_bits(rsa->n)) + { + RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_PKCS1_PADDING_TOO_SHORT); + goto err; + } break; case RSA_X931_PADDING: r=RSA_padding_check_X931(to,num,buf,i,num); diff --git a/crypto/rsa/rsa_err.c b/crypto/rsa/rsa_err.c index 163b143a73..1a7f8b7719 100644 --- a/crypto/rsa/rsa_err.c +++ b/crypto/rsa/rsa_err.c @@ -160,6 +160,7 @@ static ERR_STRING_DATA RSA_str_reasons[]= {ERR_REASON(RSA_R_N_DOES_NOT_EQUAL_P_Q) ,"n does not equal p q"}, {ERR_REASON(RSA_R_OAEP_DECODING_ERROR) ,"oaep decoding error"}, {ERR_REASON(RSA_R_PADDING_CHECK_FAILED) ,"padding check failed"}, +{ERR_REASON(RSA_R_PKCS1_PADDING_TOO_SHORT),"pkcs1 padding too short"}, {ERR_REASON(RSA_R_P_NOT_PRIME) ,"p not prime"}, {ERR_REASON(RSA_R_Q_NOT_PRIME) ,"q not prime"}, {ERR_REASON(RSA_R_RSA_OPERATIONS_NOT_SUPPORTED),"rsa operations not supported"}, diff --git a/crypto/rsa/rsa_sign.c b/crypto/rsa/rsa_sign.c index e5a015d1a6..e1b1714210 100644 --- a/crypto/rsa/rsa_sign.c +++ b/crypto/rsa/rsa_sign.c @@ -193,6 +193,23 @@ int int_rsa_verify(int dtype, const unsigned char *m, sig=d2i_X509_SIG(NULL,&p,(long)i); if (sig == NULL) goto err; + + /* Excess data can be used to create forgeries */ + if(p != s+i) + { + RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; + } + + /* Parameters to the signature algorithm can also be used to + create forgeries */ + if(sig->algor->parameter + && ASN1_TYPE_get(sig->algor->parameter) != V_ASN1_NULL) + { + RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); + goto err; + } + sigtype=OBJ_obj2nid(sig->algor->algorithm); |