From 5fdc289903bd3a77d455583650b00297da0cae8f Mon Sep 17 00:00:00 2001 From: Omair Majid Date: Fri, 2 Feb 2024 15:51:23 -0500 Subject: [PATCH] Revert "Disable implicit rejection for RSA PKCS#1 (#95216)" This reverts commit a5fc8ff9b03ffb2fdb81dad524ad1a20a0714995. To quote Clemens Lang: > [Disabling implcit rejection] re-enables a Bleichenbacher timing oracle > attack against PKCS#1v1.5 decryption. See > https://people.redhat.com/~hkario/marvin/ for details and > https://github.com/dotnet/runtime/pull/95157#issuecomment-1842784399 for a > comment by the researcher who published the vulnerability and proposed the > change in OpenSSL. For more details, see: https://github.com/dotnet/runtime/pull/95216#issuecomment-1842799314 --- .../RSA/EncryptDecrypt.cs | 49 ++++--------------- .../opensslshim.h | 6 --- .../pal_evp_pkey_rsa.c | 28 ----------- 3 files changed, 10 insertions(+), 73 deletions(-) diff --git a/src/runtime/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs b/src/runtime/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs index 0aaffebe5..011206433 100644 --- a/src/runtime/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs +++ b/src/runtime/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs @@ -358,10 +358,19 @@ private void RsaCryptRoundtrip(RSAEncryptionPadding paddingMode, bool expectSucc Assert.Equal(TestData.HelloBytes, output); } - [ConditionalFact(typeof(EncryptDecrypt), nameof(PlatformSupportsEmptyRSAEncryption))] + [ConditionalFact] [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework)] public void RoundtripEmptyArray() { + if (OperatingSystem.IsIOS() && !OperatingSystem.IsIOSVersionAtLeast(13, 6)) + { + throw new SkipTestException("iOS prior to 13.6 does not reliably support RSA encryption of empty data."); + } + if (OperatingSystem.IsTvOS() && !OperatingSystem.IsTvOSVersionAtLeast(14, 0)) + { + throw new SkipTestException("tvOS prior to 14.0 does not reliably support RSA encryption of empty data."); + } + using (RSA rsa = RSAFactory.Create(TestData.RSA2048Params)) { void RoundtripEmpty(RSAEncryptionPadding paddingMode) @@ -868,22 +877,4 @@ public static IEnumerable OaepPaddingModes } } - - public static bool PlatformSupportsEmptyRSAEncryption - { - get - { - if (OperatingSystem.IsIOS() && !OperatingSystem.IsIOSVersionAtLeast(13, 6)) - { - return false; - } - - if (OperatingSystem.IsTvOS() && !OperatingSystem.IsTvOSVersionAtLeast(14, 0)) - { - return false; - } - - return true; - } - } } } diff --git a/src/runtime/src/native/libs/System.Security.Cryptography.Native/opensslshim.h b/src/runtime/src/native/libs/System.Security.Cryptography.Native/opensslshim.h index db613a21d..db1ceb1a3 100644 --- a/src/runtime/src/native/libs/System.Security.Cryptography.Native/opensslshim.h +++ b/src/runtime/src/native/libs/System.Security.Cryptography.Native/opensslshim.h @@ -450,10 +450,8 @@ extern bool g_libSslUses32BitTime; REQUIRED_FUNCTION(ERR_peek_error) \ REQUIRED_FUNCTION(ERR_peek_error_line) \ REQUIRED_FUNCTION(ERR_peek_last_error) \ - REQUIRED_FUNCTION(ERR_pop_to_mark) \ FALLBACK_FUNCTION(ERR_put_error) \ REQUIRED_FUNCTION(ERR_reason_error_string) \ - REQUIRED_FUNCTION(ERR_set_mark) \ LIGHTUP_FUNCTION(ERR_set_debug) \ LIGHTUP_FUNCTION(ERR_set_error) \ REQUIRED_FUNCTION(EVP_aes_128_cbc) \ @@ -530,7 +528,6 @@ extern bool g_libSslUses32BitTime; REQUIRED_FUNCTION(EVP_PKCS82PKEY) \ REQUIRED_FUNCTION(EVP_PKEY2PKCS8) \ REQUIRED_FUNCTION(EVP_PKEY_CTX_ctrl) \ - REQUIRED_FUNCTION(EVP_PKEY_CTX_ctrl_str) \ REQUIRED_FUNCTION(EVP_PKEY_CTX_free) \ REQUIRED_FUNCTION(EVP_PKEY_CTX_get0_pkey) \ REQUIRED_FUNCTION(EVP_PKEY_CTX_new) \ @@ -1048,10 +1045,8 @@ extern TYPEOF(OPENSSL_gmtime)* OPENSSL_gmtime_ptr; #define ERR_peek_error_line ERR_peek_error_line_ptr #define ERR_peek_last_error ERR_peek_last_error_ptr #define ERR_put_error ERR_put_error_ptr -#define ERR_pop_to_mark ERR_pop_to_mark_ptr #define ERR_reason_error_string ERR_reason_error_string_ptr #define ERR_set_debug ERR_set_debug_ptr -#define ERR_set_mark ERR_set_mark_ptr #define ERR_set_error ERR_set_error_ptr #define EVP_aes_128_cbc EVP_aes_128_cbc_ptr #define EVP_aes_128_cfb8 EVP_aes_128_cfb8_ptr @@ -1127,7 +1122,6 @@ extern TYPEOF(OPENSSL_gmtime)* OPENSSL_gmtime_ptr; #define EVP_PKCS82PKEY EVP_PKCS82PKEY_ptr #define EVP_PKEY2PKCS8 EVP_PKEY2PKCS8_ptr #define EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_ptr -#define EVP_PKEY_CTX_ctrl_str EVP_PKEY_CTX_ctrl_str_ptr #define EVP_PKEY_CTX_free EVP_PKEY_CTX_free_ptr #define EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get0_pkey_ptr #define EVP_PKEY_CTX_new EVP_PKEY_CTX_new_ptr diff --git a/src/runtime/src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c b/src/runtime/src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c index a6040b939..34cf0087a 100644 --- a/src/runtime/src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c +++ b/src/runtime/src/native/libs/System.Security.Cryptography.Native/pal_evp_pkey_rsa.c @@ -80,36 +80,6 @@ static bool ConfigureEncryption(EVP_PKEY_CTX* ctx, RsaPaddingMode padding, const { return false; } - - // OpenSSL 3.2 introduced "implicit rejection" for PKCS#1 RSA decryption - // (https://github.com/openssl/openssl/pull/13817). Instead of returning an error for invalid - // padding (software keys only), OpenSSL synthesizes a deterministic random value derived from the - // private key and ciphertext, leaving callers to handle it with constant-time comparison. This - // was intended to mitigate Bleichenbacher-style padding oracle attacks. - // - // Some Linux distributions (notably CentOS/RHEL via Red Hat backports) applied this change to - // earlier OpenSSL versions (e.g. 3.1), which broke some .NET tests. - // - // We disable this feature ("implicit rejection") for several reasons: - // 1. Platform consistency: other platforms (Windows, macOS) and hardware-backed keys still - // return explicit errors; callers should see the same behavior everywhere. - // 2. It deviates from RSA specifications and OpenSSL itself had to disable it to pass FIPS - // conformance tests. - // 3. It broke OpenSSL's own CMS (EnvelopedCMS) implementation, so OpenSSL turns it off - // internally when doing CMS operations. - // 4. It does not fully solve the Bleichenbacher problem; it converts a "FFT" oracle into a - // "FFF" oracle. While FFF is ~1000x harder to exploit, the attack is not eliminated. - // - // Therefore we revert to the prior behavior: invalid padding produces an explicit error code - // and .NET throws an exception. This is a best-effort flag; if the running OpenSSL version does - // not recognize it, we silently ignore the failure (see ERR_set_mark / ERR_pop_to_mark below). - ERR_set_mark(); - - EVP_PKEY_CTX_ctrl_str(ctx, "rsa_pkcs1_implicit_rejection", "0"); - - // Undo any changes to the error queue that may have occurred while configuring implicit rejection if the - // current version does not support implicit rejection. - ERR_pop_to_mark(); } else { -- 2.53.0