1. 10 Sep, 2019 7 commits
  2. 09 Sep, 2019 10 commits
    • Dr. Matthias St. Pierre's avatar
      drbg: fix issue where DRBG_CTR fails if NO_DF is used (2nd attempt) · 63180182
      Dr. Matthias St. Pierre authored
      Since commit 7c226dfc
      
       a chained DRBG does not add additional
      data anymore when reseeding from its parent. The reason is that
      the size of the additional data exceeded the allowed size when
      no derivation function was used.
      
      This commit provides an alternative fix: instead of adding the
      entire DRBG's complete state, we just add the DRBG's address
      in memory, thereby providing some distinction between the different
      DRBG instances.
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9802)
      63180182
    • Dr. Matthias St. Pierre's avatar
      drbg: add fork id to additional data on UNIX systems · 5520695c
      Dr. Matthias St. Pierre authored
      
      
      Provides a little extra fork-safety on UNIX systems, adding to the
      fact that all DRBGs reseed automatically when the fork_id changes.
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9802)
      5520695c
    • Dr. Matthias St. Pierre's avatar
      drbg: ensure fork-safety without using a pthread_atfork handler · 1b0fe00e
      Dr. Matthias St. Pierre authored
      When the new OpenSSL CSPRNG was introduced in version 1.1.1,
      it was announced in the release notes that it would be fork-safe,
      which the old CSPRNG hadn't been.
      
      The fork-safety was implemented using a fork count, which was
      incremented by a pthread_atfork handler. Initially, this handler
      was enabled by default. Unfortunately, the default behaviour
      had to be changed for other reasons in commit b5319bdb
      
      , so
      the new OpenSSL CSPRNG failed to keep its promise.
      
      This commit restores the fork-safety using a different approach.
      It replaces the fork count by a fork id, which coincides with
      the process id on UNIX-like operating systems and is zero on other
      operating systems. It is used to detect when an automatic reseed
      after a fork is necessary.
      
      To prevent a future regression, it also adds a test to verify that
      the child reseeds after fork.
      
      CVE-2019-1549
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9802)
      1b0fe00e
    • Billy Brumley's avatar
      [test] ECC: check the bounds for auto computing cofactor · 73a683b7
      Billy Brumley authored
      
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      Reviewed-by: default avatarNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/9821)
      
      (cherry picked from commit 1d3cd983f56e0a580ee4216692ee3c9c7bf14de9)
      73a683b7
    • Bernd Edlinger's avatar
      Fix build with VS2008 · 827eab4c
      Bernd Edlinger authored
      
      
      crypto/rand/rand_win.c(70) : error C2065: 'BCRYPT_USE_SYSTEM_PREFERRED_RNG' : undeclared identifier
      
      Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9827)
      
      (cherry picked from commit d3a1128bc25ec8bf835c81821e1be68fba39ab4b)
      827eab4c
    • Bernd Edlinger's avatar
      Use BN_clear_free in DH_set0_key · 4bf9781a
      Bernd Edlinger authored
      
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/9796)
      
      (cherry picked from commit fa01370f7dc8f0a379483bbe74de11225857e5fe)
      4bf9781a
    • Bernd Edlinger's avatar
      DH_check_pub_key_ex was accidentally calling DH_check, · 8003138f
      Bernd Edlinger authored
      
      so results were undefined.
      
      Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/9796)
      
      (cherry picked from commit 2b95e8efcf8b99892106070d9ac745a0a369f503)
      8003138f
    • Bernd Edlinger's avatar
      Change DH_generate_parameters back to order 2q subgroup · 1f9dc86b
      Bernd Edlinger authored
      
      
      For for G=2 and 5 DH_generate_parameters will continue to generate
      the order 2q subgroup for compatibility with previous versions.
      
      For G=3 DH_generate_parameters generates an order q subgroup, but it
      will not pass the check in DH_check with previous OpenSSL versions.
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9820)
      1f9dc86b
    • Nicola Tuveri's avatar
      Fix spacing nit in test/ectest.c · 288241b6
      Nicola Tuveri authored
      
      
      (cherry picked from commit 65936a56461fe09e8c81bca45122af5adcfabb00)
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      Reviewed-by: default avatarBernd Edlinger <bernd.edlinger@hotmail.de>
      (Merged from https://github.com/openssl/openssl/pull/9813)
      288241b6
    • Nicola Tuveri's avatar
      [ec] Match built-in curves on EC_GROUP_new_from_ecparameters · 9a43a733
      Nicola Tuveri authored
      Description
      -----------
      
      Upon `EC_GROUP_new_from_ecparameters()` check if the parameters match any
      of the built-in curves. If that is the case, return a new
      `EC_GROUP_new_by_curve_name()` object instead of the explicit parameters
      `EC_GROUP`.
      
      This affects all users of `EC_GROUP_new_from_ecparameters()`:
      - direct calls to `EC_GROUP_new_from_ecparameters()`
      - direct calls to `EC_GROUP_new_from_ecpkparameters()` with an explicit
        parameters argument
      - ASN.1 parsing of explicit parameters keys (as it eventually
        ends up calling `EC_GROUP_new_from_ecpkparameters()`)
      
      A parsed explicit parameter key will still be marked with the
      `OPENSSL_EC_EXPLICIT_CURVE` ASN.1 flag on load, so, unless
      programmatically forced otherwise, if the key is eventually serialized
      the output will still be encoded with explicit parameters, even if
      internally it is treated as a named curve `EC_GROUP`.
      
      Before this change, creating any `EC_GROUP` object using
      `EC_GROUP_new_from_ecparameters()`, yielded an object associated with
      the default generic `EC_METHOD`, but this was never guaranteed in the
      documentation.
      After this commit, users of the library that intentionally want to
      create an `EC_GROUP` object using a specific `EC_METHOD` can still
      explicitly call `EC_GROUP_new(foo_method)` and then manually set the
      curve parameters using `EC_GROUP_set_*()`.
      
      Motivation
      ----------
      
      This has obvious performance benefits for the built-in curves with
      specialized `EC_METHOD`s and subtle but important security benefits:
      - the specialized methods have better security hardening than the
        generic implementations
      - optional fields in the parameter encoding, like the `cofactor`, cannot
        be leveraged by an attacker to force execution of the less secure
        code-paths for single point scalar multiplication
      - in general, this leads to reducing the attack surface
      
      Check the manuscript at https://arxiv.org/abs/1909.01785 for an in depth
      analysis of the issues related to this commit.
      
      It should be noted that `libssl` does not allow to negotiate explicit
      parameters (as per RFC 8422), so it is not directly affected by the
      consequences of using explicit parameters that this commit fixes.
      On the other hand, we detected external applications and users in the
      wild that use explicit parameters by default (and sometimes using 0 as
      the cofactor value, which is technically not a valid value per the
      specification, but is tolerated by parsers for wider compatibility given
      that the field is optional).
      These external users of `libcrypto` are exposed to these vulnerabilities
      and their security will benefit from this commit.
      
      Related commits
      ---------------
      
      While this commit is beneficial for users using built-in curves and
      explicit parameters encoding for serialized keys, commit
      b783beeadf6b80bc431e6f3230b5d5585c87ef87 (and its equivalents for the
      1.0.2, 1.1.0 and 1.1.1 stable branches) fixes the consequences of the
      invalid cofactor values more in general also for other curves
      (CVE-2019-1547).
      
      The following list covers commits in `master` that are related to the
      vulnerabilities presented in the manuscript motivating this commit:
      
      - d2baf88c43 [crypto/rsa] Set the constant-time flag in multi-prime RSA too
      - 311e903d84 [crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
      - b783beeadf [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it
      - 724339ff44 Fix SCA vulnerability when using PVK and MSBLOB key formats
      
      Note that the PRs that contributed the listed commits also include other
      commits providing related testing and documentation, in addition to
      links to PRs and commits backporting the fixes to the 1.0.2, 1.1.0 and
      1.1.1 branches.
      
      This commit includes a partial backport of
      https://github.com/openssl/openssl/pull/8555
      (commit 8402cd5f75f8c2f60d8bd39775b24b03dd8b3b38)
      for which the main author is Shane Lontis.
      
      Responsible Disclosure
      ----------------------
      
      This and the other issues presented in https://arxiv.org/abs/1909.01785
      
      
      were reported by Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri,
      Iaroslav Gridin, Alejandro Cabrera Aldaya and Billy Bob Brumley from the
      NISEC group at Tampere University, FINLAND.
      
      The OpenSSL Security Team evaluated the security risk for this
      vulnerability as low, and encouraged to propose fixes using public Pull
      Requests.
      
      _______________________________________________________________________________
      
      Co-authored-by: default avatarShane Lontis <shane.lontis@oracle.com>
      
      (Backport from https://github.com/openssl/openssl/pull/9808
      
      )
      
      Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/9809)
      9a43a733
  3. 08 Sep, 2019 1 commit
  4. 07 Sep, 2019 5 commits
  5. 06 Sep, 2019 10 commits
  6. 05 Sep, 2019 3 commits
  7. 04 Sep, 2019 4 commits