| From db925ae2e65d0d925adef429afc37f75bd1c2017 Mon Sep 17 00:00:00 2001 |
| From: Richard Levitte <levitte@openssl.org> |
| Date: Fri, 20 Oct 2023 09:18:19 +0200 |
| Subject: [PATCH] Make DH_check_pub_key() and DH_generate_key() safer yet |
| |
| We already check for an excessively large P in DH_generate_key(), but not in |
| DH_check_pub_key(), and none of them check for an excessively large Q. |
| |
| This change adds all the missing excessive size checks of P and Q. |
| |
| It's to be noted that behaviours surrounding excessively sized P and Q |
| differ. DH_check() raises an error on the excessively sized P, but only |
| sets a flag for the excessively sized Q. This behaviour is mimicked in |
| DH_check_pub_key(). |
| |
| Reviewed-by: Tomas Mraz <tomas@openssl.org> |
| Reviewed-by: Matt Caswell <matt@openssl.org> |
| Reviewed-by: Hugo Landau <hlandau@openssl.org> |
| (Merged from https://github.com/openssl/openssl/pull/22518) |
| |
| (cherry picked from commit ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6) |
| --- |
| crypto/dh/dh_check.c | 12 ++++++++++++ |
| crypto/dh/dh_err.c | 2 ++ |
| crypto/dh/dh_key.c | 12 ++++++++++++ |
| crypto/err/openssl.txt | 2 ++ |
| doc/man3/DH_generate_parameters.pod | 4 ++++ |
| include/openssl/dh.h | 3 ++- |
| include/openssl/dherr.h | 3 +++ |
| 7 files changed, 37 insertions(+), 1 deletion(-) |
| |
| diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c |
| index ae1b03b..7512175 100644 |
| --- a/crypto/dh/dh_check.c |
| +++ b/crypto/dh/dh_check.c |
| @@ -197,6 +197,18 @@ int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) |
| BIGNUM *tmp = NULL; |
| BN_CTX *ctx = NULL; |
| |
| + /* Don't do any checks at all with an excessively large modulus */ |
| + if (BN_num_bits(dh->p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) { |
| + DHerr(DH_F_DH_CHECK_PUB_KEY, DH_R_MODULUS_TOO_LARGE); |
| + *ret = DH_MODULUS_TOO_LARGE | DH_CHECK_PUBKEY_INVALID; |
| + return 0; |
| + } |
| + |
| + if (dh->q != NULL && BN_ucmp(dh->p, dh->q) < 0) { |
| + *ret |= DH_CHECK_INVALID_Q_VALUE | DH_CHECK_PUBKEY_INVALID; |
| + return 1; |
| + } |
| + |
| *ret = 0; |
| ctx = BN_CTX_new(); |
| if (ctx == NULL) |
| diff --git a/crypto/dh/dh_err.c b/crypto/dh/dh_err.c |
| index 92800d3..048ba66 100644 |
| --- a/crypto/dh/dh_err.c |
| +++ b/crypto/dh/dh_err.c |
| @@ -21,6 +21,7 @@ static const ERR_STRING_DATA DH_str_functs[] = { |
| {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK, 0), "DH_check"}, |
| {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_EX, 0), "DH_check_ex"}, |
| {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PARAMS_EX, 0), "DH_check_params_ex"}, |
| + {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PUB_KEY, 0), "DH_check_pub_key"}, |
| {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PUB_KEY_EX, 0), "DH_check_pub_key_ex"}, |
| {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_DECRYPT, 0), "dh_cms_decrypt"}, |
| {ERR_PACK(ERR_LIB_DH, DH_F_DH_CMS_SET_PEERKEY, 0), "dh_cms_set_peerkey"}, |
| @@ -82,6 +83,7 @@ static const ERR_STRING_DATA DH_str_reasons[] = { |
| {ERR_PACK(ERR_LIB_DH, 0, DH_R_PARAMETER_ENCODING_ERROR), |
| "parameter encoding error"}, |
| {ERR_PACK(ERR_LIB_DH, 0, DH_R_PEER_KEY_ERROR), "peer key error"}, |
| + {ERR_PACK(ERR_LIB_DH, 0, DH_R_Q_TOO_LARGE), "q too large"}, |
| {ERR_PACK(ERR_LIB_DH, 0, DH_R_SHARED_INFO_ERROR), "shared info error"}, |
| {ERR_PACK(ERR_LIB_DH, 0, DH_R_UNABLE_TO_CHECK_GENERATOR), |
| "unable to check generator"}, |
| diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c |
| index 117f2fa..662ea1f 100644 |
| --- a/crypto/dh/dh_key.c |
| +++ b/crypto/dh/dh_key.c |
| @@ -34,6 +34,12 @@ int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) |
| int ret = 0, i; |
| volatile size_t npad = 0, mask = 1; |
| |
| + if (dh->q != NULL |
| + && BN_num_bits(dh->q) > OPENSSL_DH_MAX_MODULUS_BITS) { |
| + DHerr(DH_F_DH_COMPUTE_KEY, DH_R_Q_TOO_LARGE); |
| + return 0; |
| + } |
| + |
| /* compute the key; ret is constant unless compute_key is external */ |
| if ((ret = dh->meth->compute_key(key, pub_key, dh)) <= 0) |
| return ret; |
| @@ -114,6 +120,12 @@ static int generate_key(DH *dh) |
| return 0; |
| } |
| |
| + if (dh->q != NULL |
| + && BN_num_bits(dh->q) > OPENSSL_DH_MAX_MODULUS_BITS) { |
| + DHerr(DH_F_GENERATE_KEY, DH_R_Q_TOO_LARGE); |
| + return 0; |
| + } |
| + |
| ctx = BN_CTX_new(); |
| if (ctx == NULL) |
| goto err; |
| diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt |
| index c0a3cd7..4446eea 100644 |
| --- a/crypto/err/openssl.txt |
| +++ b/crypto/err/openssl.txt |
| @@ -404,6 +404,7 @@ DH_F_DH_BUILTIN_GENPARAMS:106:dh_builtin_genparams |
| DH_F_DH_CHECK:126:DH_check |
| DH_F_DH_CHECK_EX:121:DH_check_ex |
| DH_F_DH_CHECK_PARAMS_EX:122:DH_check_params_ex |
| +DH_F_DH_CHECK_PUB_KEY:128:DH_check_pub_key |
| DH_F_DH_CHECK_PUB_KEY_EX:123:DH_check_pub_key_ex |
| DH_F_DH_CMS_DECRYPT:114:dh_cms_decrypt |
| DH_F_DH_CMS_SET_PEERKEY:115:dh_cms_set_peerkey |
| @@ -2106,6 +2107,7 @@ DH_R_NO_PARAMETERS_SET:107:no parameters set |
| DH_R_NO_PRIVATE_VALUE:100:no private value |
| DH_R_PARAMETER_ENCODING_ERROR:105:parameter encoding error |
| DH_R_PEER_KEY_ERROR:111:peer key error |
| +DH_R_Q_TOO_LARGE:130:q too large |
| DH_R_SHARED_INFO_ERROR:113:shared info error |
| DH_R_UNABLE_TO_CHECK_GENERATOR:121:unable to check generator |
| DSA_R_BAD_Q_VALUE:102:bad q value |
| diff --git a/doc/man3/DH_generate_parameters.pod b/doc/man3/DH_generate_parameters.pod |
| index 3c84710..253bf08 100644 |
| --- a/doc/man3/DH_generate_parameters.pod |
| +++ b/doc/man3/DH_generate_parameters.pod |
| @@ -73,6 +73,10 @@ The generator B<g> is not suitable. |
| Note that the lack of this bit doesn't guarantee that B<g> is |
| suitable, unless B<p> is known to be a strong prime. |
| |
| +=item DH_MODULUS_TOO_LARGE |
| + |
| +The modulus is too large. |
| + |
| =back |
| |
| DH_check() confirms that the Diffie-Hellman parameters B<dh> are valid. The |
| diff --git a/include/openssl/dh.h b/include/openssl/dh.h |
| index 6c6ff36..111c21b 100644 |
| --- a/include/openssl/dh.h |
| +++ b/include/openssl/dh.h |
| @@ -77,8 +77,9 @@ DECLARE_ASN1_ITEM(DHparams) |
| # define DH_UNABLE_TO_CHECK_GENERATOR 0x04 |
| # define DH_NOT_SUITABLE_GENERATOR 0x08 |
| # define DH_CHECK_Q_NOT_PRIME 0x10 |
| -# define DH_CHECK_INVALID_Q_VALUE 0x20 |
| +# define DH_CHECK_INVALID_Q_VALUE 0x20 /* +DH_check_pub_key */ |
| # define DH_CHECK_INVALID_J_VALUE 0x40 |
| +# define DH_MODULUS_TOO_LARGE 0x100 /* +DH_check_pub_key */ |
| |
| /* DH_check_pub_key error codes */ |
| # define DH_CHECK_PUBKEY_TOO_SMALL 0x01 |
| diff --git a/include/openssl/dherr.h b/include/openssl/dherr.h |
| index 528c819..1059386 100644 |
| --- a/include/openssl/dherr.h |
| +++ b/include/openssl/dherr.h |
| @@ -33,10 +33,12 @@ int ERR_load_DH_strings(void); |
| # define DH_F_DH_CHECK 126 |
| # define DH_F_DH_CHECK_EX 121 |
| # define DH_F_DH_CHECK_PARAMS_EX 122 |
| +# define DH_F_DH_CHECK_PUB_KEY 128 |
| # define DH_F_DH_CHECK_PUB_KEY_EX 123 |
| # define DH_F_DH_CMS_DECRYPT 114 |
| # define DH_F_DH_CMS_SET_PEERKEY 115 |
| # define DH_F_DH_CMS_SET_SHARED_INFO 116 |
| +# define DH_F_DH_COMPUTE_KEY 203 |
| # define DH_F_DH_METH_DUP 117 |
| # define DH_F_DH_METH_NEW 118 |
| # define DH_F_DH_METH_SET1_NAME 119 |
| @@ -82,6 +84,7 @@ int ERR_load_DH_strings(void); |
| # define DH_R_NO_PRIVATE_VALUE 100 |
| # define DH_R_PARAMETER_ENCODING_ERROR 105 |
| # define DH_R_PEER_KEY_ERROR 111 |
| +# define DH_R_Q_TOO_LARGE 130 |
| # define DH_R_SHARED_INFO_ERROR 113 |
| # define DH_R_UNABLE_TO_CHECK_GENERATOR 121 |
| |
| -- |
| 2.43.0.594.gd9cf4e227d-goog |
| |
