[61213] in cryptography@c2.net mail archive
RE: Why the exponent 3 error happened:
daemon@ATHENA.MIT.EDU (Kuehn, Ulrich)
Fri Nov 10 13:12:54 2006
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Thu, 9 Nov 2006 10:44:31 +0100
In-Reply-To: <20060917040057.B3C8114F6BC@finney.org>
From: "Kuehn, Ulrich" <Ulrich.Kuehn@telekom.de>
To: <hal@finney.org>, <cryptography@metzdowd.com>
=20
> From: hal@finney.org [mailto:hal@finney.org]=20
> Sent: Sonntag, 17. September 2006 06:01
>=20
> For another example of just how badly this kind of thing can=20
> be done, look at this code excerpt from Firefox version=20
> 1.5.0.7, which is the fixed version. There are two PKCS-1=20
> parsing functions, one which returns the hash and its prefix,=20
> the other of which is given the hash and asked whether it=20
> matches the RSA-signed value. This is from the latter one:
>=20
> /*
> * check the padding that was used
> */
> if (buffer[0] !=3D 0 || buffer[1] !=3D 1)
> goto loser;
> for (i =3D 2; i < modulus_len - hash_len - 1; i++) {
> if (buffer[i] =3D=3D 0)
> break;
> if (buffer[i] !=3D 0xff)
> goto loser;
> }
>=20
> /*
> * make sure we get the same results
> */
> if (PORT_Memcmp(buffer + modulus_len - hash_len, hash,=20
> hash_len) !=3D 0)
> goto loser;
>=20
> PORT_Free(buffer);
> return SECSuccess;
>=20
> Here, buffer holds the result of the RSA exponentiation, of=20
> size modulus_len, and we are passed hash of size hash_len to compare.
>=20
> I don't think this code is used, fortunately. It will accept=20
> anything of the form 0, 1, 0, garbage, hash. Just goes to=20
> show how easy it is to get this kind of parsing wrong.
>=20
Unfortunately, this code _is_ used! It took me quite a while to =
understand under what circumstances, but here is the result. The problem =
is fixed as of version 1.5.0.8 (out now). Interestingly, the mozilla =
people fixed it by themselves in the 2.0 version (and any public beta I =
could find), but for the 1.5 version it took my bug report...
So here is how the code is used and some hints (I am reluctant to give =
out the details right now, given that there are still many vulnerable =
systems out there. However, I am sure you can easily work out the =
details):
Whenever a SSL or TLS server send a ServerKeyExchange message, the key =
contained in there is signed with a fresh nonce. This signature is =
checked using RSA_CheckSign().=20
Faking a signature for a key with a small exponent like 3 is easy. This =
can be used to break the SSL/TLS authentication.
Better upgrade asap...
Regards,
Ulrich
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
