[47393] in cryptography@c2.net mail archive
RE: Exponent 3 damage spreads...
daemon@ATHENA.MIT.EDU (Kuehn, Ulrich)
Thu Sep 28 09:30:42 2006
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Wed, 27 Sep 2006 11:58:49 +0200
in-reply-to: <1A96CC5A-A5A2-466F-813D-8D190CDD5366@cdc.informatik.tu-darmstadt.de>
From: "Kuehn, Ulrich" <Ulrich.Kuehn@telekom.de>
To: <weinmann@cdc.informatik.tu-darmstadt.de>, <jas@extundo.com>
Cc: <leichter_jerrold@emc.com>, <pgut001@cs.auckland.ac.nz>,
<cryptography@metzdowd.com>, <e_tews@cdc.informatik.tu-darmstadt.de>
=20
> From: Ralf-Philipp Weinmann=20
> [...]
> Relevant files to this problem that were patched turned out=20
> to be security/nss/lib/cryptohi/secvfy.c and=20
> nss/lib/util/secdig.c. Have a look at the function=20
> DecryptSigBlock() in secdig.c, lines 92-95
>=20
> > /* make sure the "parameters" are not too bogus. */
> > if (di->digestAlgorithm.parameters.len > 2) {
> > goto sigloser;
> > }
>=20
> Quite amused, we also noted the following:
>=20
> < /* XXX Check that tag is an appropriate algorithm? */
> ---
> > /* Check that tag is an appropriate algorithm */
> > if (tag =3D=3D SEC_OID_UNKNOWN) {
> > goto sigloser;
> > }
>=20
> This means, that before the patch was applied, NSS indeed was=20
> vulnerable to Kaliski's OID attack.
>=20
While the patch for Firefox obviously fixed the bugs in =
security/nss/lib/cryptohi/<whatever>,
There is another pkcs#1-padding check in =
security/nss/lib/softtoken/rsawrapr.c, see function
RSA_CheckSign() and RSA_CheckSignRecover(). Does anybody know what these =
functions are used for?
I tried to find that out, but did not get very far...=20
(Hal Finney also noted these functions some days ago).
It seems to be another creative bug:
/*
* check the padding that was used
*/
if (buffer[0] !=3D 0 || buffer[1] !=3D 1)=20
goto loser;
for (i =3D 2; i < modulus_len - hash_len - 1; i++) {
if (buffer[i] =3D=3D 0)=20
break;
if (buffer[i] !=3D 0xff)=20
goto loser;
}
/*
* make sure we get the same results
*/
if (PORT_Memcmp(buffer + modulus_len - hash_len, hash, hash_len) =
!=3D 0)
goto loser;
So it would accept a padding ( 00 || 01 || 00 || garbage || hash ), =
which is not exactly what pkcs#1 says :)
The same loop is used in RSA_CheckSignRecover(), but I did not succeed =
in finding out what it is exactly used for and if that is a safe =
application of the rather wrong code.
Cheers,
Ulrich
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
