From 1386e9b75feeff4ed5446b0169d286e54d7317ff Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Thu, 6 Apr 2017 21:16:38 -0400 Subject: Defend against Bleichenbacher's Attack in hal_rpc_pkey_import(). Borrowing an idea from PyCrypto, we substitute CSPRNG output for the value of a decrypted KEK if the PKCS #1.5 type 02 block format check fails. Done properly, this should be very close to constant-time, and should make it harder to use hal_rpc_pkey_import() as an oracle. --- rpc_pkey.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) (limited to 'rpc_pkey.c') diff --git a/rpc_pkey.c b/rpc_pkey.c index ce67614..9473ec3 100644 --- a/rpc_pkey.c +++ b/rpc_pkey.c @@ -1217,14 +1217,13 @@ static hal_error_t pkey_local_import(const hal_client_handle_t client, if ((err = hal_rsa_decrypt(NULL, rsa, data, data_len, der, data_len)) != HAL_OK) goto fail; - d = memchr(der + 2, 0x00, data_len - 2); - - if (der[0] != 0x00 || der[1] != 0x02 || d == NULL || der + data_len != d + 1 + KEK_LENGTH) { - err = HAL_ERROR_ASN1_PARSE_FAILED; + if ((err = hal_get_random(NULL, kek, sizeof(kek))) != HAL_OK) goto fail; - } - memcpy(kek, d + 1, sizeof(kek)); + d = memchr(der + 2, 0x00, data_len - 2); + + if (der[0] == 0x00 && der[1] == 0x02 && d != NULL && der + data_len == d + 1 + KEK_LENGTH) + memcpy(kek, d + 1, sizeof(kek)); if ((err = hal_asn1_decode_pkcs8_encryptedprivatekeyinfo(&oid, &oid_len, &data, &data_len, pkcs8, pkcs8_len)) != HAL_OK) goto fail; -- cgit v1.2.3