generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add additional DigestInfo checks.

Browse Source 
Reencode DigestInto in DER and check against the original: this
will reject any improperly encoded DigestInfo structures.

Note: this is a precautionary measure, there is no known attack
which can exploit this.

Thanks to Brian Smith for reporting this issue.
Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2014-09-29 12:16:13 +01:00
parent 116fd3732a
commit 5a7fc89394
2 changed files with 29 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
CHANGES
View File

@ -4,7 +4,15 @@
Changes between 0.9.8zb and 0.9.8zc [xx XXX xxxx] Changes between 0.9.8zb and 0.9.8zc [xx XXX xxxx]
*) *) Add additional DigestInfo checks.
Reencode DigestInto in DER and check against the original when
verifying RSA signature: this will reject any improperly encoded
DigestInfo structures.
Note: this is a precautionary measure and no attacks are currently known.
[Steve Henson]
Changes between 0.9.8za and 0.9.8zb [6 Aug 2014] Changes between 0.9.8za and 0.9.8zb [6 Aug 2014]

21
crypto/rsa/rsa_sign.c
View File

@ -155,6 +155,25 @@ int RSA_sign(int type, const unsigned char *m, unsigned int m_len,
return(ret); return(ret);
} }
/*
* Check DigestInfo structure does not contain extraneous data by reencoding
* using DER and checking encoding against original.
*/
static int rsa_check_digestinfo(X509_SIG *sig, const unsigned char *dinfo, int dinfolen)
{
unsigned char *der = NULL;
int derlen;
int ret = 0;
derlen = i2d_X509_SIG(sig, &der);
if (derlen <= 0)
return 0;
if (derlen == dinfolen && !memcmp(dinfo, der, derlen))
ret = 1;
OPENSSL_cleanse(der, derlen);
OPENSSL_free(der);
return ret;
}
int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len, int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
unsigned char *sigbuf, unsigned int siglen, RSA *rsa) unsigned char *sigbuf, unsigned int siglen, RSA *rsa)
{ {
@ -215,7 +234,7 @@ int RSA_verify(int dtype, const unsigned char *m, unsigned int m_len,
if (sig == NULL) goto err; if (sig == NULL) goto err;
/* Excess data can be used to create forgeries */ /* Excess data can be used to create forgeries */
if(p != s+i) if(p != s+i || !rsa_check_digestinfo(sig, s, i))
{ {
RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE); RSAerr(RSA_F_RSA_VERIFY,RSA_R_BAD_SIGNATURE);
goto err; goto err;