diff options
| author | David Benjamin <davidben@google.com> | 2016-08-20 13:35:17 -0400 |
|---|---|---|
| committer | Kurt Roeckx <kurt@roeckx.be> | 2016-11-07 21:06:48 +0100 |
| commit | b71079a375116a8a52ed493afcd8f69cb08c195a (patch) | |
| tree | 8176bcb26fded3ca805b951fc0b11051b9854f6f /include | |
| parent | 929cc3fa6bceba1c6d9c362c56b89cbf2acf40bc (diff) | |
Implement RSASSA-PKCS1-v1_5 as specified.
RFC 3447, section 8.2.2, steps 3 and 4 states that verifiers must encode
the DigestInfo struct and then compare the result against the public key
operation result. This implies that one and only one encoding is legal.
OpenSSL instead parses with crypto/asn1, then checks that the encoding
round-trips, and allows some variations for the parameter. Sufficient
laxness in this area can allow signature forgeries, as described in
https://www.imperialviolet.org/2014/09/26/pkcs1.html
Although there aren't known attacks against OpenSSL's current scheme,
this change makes OpenSSL implement the algorithm as specified. This
avoids the uncertainty and, more importantly, helps grow a healthy
ecosystem. Laxness beyond the spec, particularly in implementations
which enjoy wide use, risks harm to the ecosystem for all. A signature
producer which only tests against OpenSSL may not notice bugs and
accidentally become widely deployed. Thus implementations have a
responsibility to honor the specification as tightly as is practical.
In some cases, the damage is permanent and the spec deviation and
security risk becomes a tax all implementors must forever pay, but not
here. Both BoringSSL and Go successfully implemented and deployed
RSASSA-PKCS1-v1_5 as specified since their respective beginnings, so
this change should be compatible enough to pin down in future OpenSSL
releases.
See also https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00
As a bonus, by not having to deal with sign/verify differences, this
version is also somewhat clearer. It also more consistently enforces
digest lengths in the verify_recover codepath. The NID_md5_sha1 codepath
wasn't quite doing this right.
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1474
(cherry picked from commit 608a026494c1e7a14f6d6cfcc5e4994fe2728836)
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/rsa.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/openssl/rsa.h b/include/openssl/rsa.h index 9721218e1a..4d6e9cc9a9 100644 --- a/include/openssl/rsa.h +++ b/include/openssl/rsa.h @@ -462,6 +462,7 @@ int ERR_load_RSA_strings(void); /* Function codes. */ # define RSA_F_CHECK_PADDING_MD 140 +# define RSA_F_ENCODE_PKCS1 146 # define RSA_F_INT_RSA_VERIFY 145 # define RSA_F_OLD_RSA_PRIV_DECODE 147 # define RSA_F_PKEY_RSA_CTRL 143 |