Skip to content

Disable implicit rejection for RSA PKCS#1 v1.5#95157

Merged
bartonjs merged 1 commit into
dotnet:mainfrom
vcsjones:rsa-implicit-encryption
Nov 24, 2023
Merged

Disable implicit rejection for RSA PKCS#1 v1.5#95157
bartonjs merged 1 commit into
dotnet:mainfrom
vcsjones:rsa-implicit-encryption

Conversation

@vcsjones

@vcsjones vcsjones commented Nov 23, 2023

Copy link
Copy Markdown
Member

Starting in OpenSSL 3.2, RSA PKCS#1 v1.5 decryption no longer fails for invalid RSA padding. Instead, it produces random output data. This was introduced in openssl/openssl#13817.

Some Linux distributions back ported this to OpenSSL 3.1.x which resulted in failures seen in #95115.

This disables the "implicit rejection" of PKCS#1 v1.5 RSA decryption so that RSA.Encrypt and RSA.Decrypt continue to follow their documented behavior and cross-platform behavior.

Fixes #95115.

@ghost ghost added the area-System.Security label Nov 23, 2023
@ghost ghost assigned vcsjones Nov 23, 2023
@ghost

ghost commented Nov 23, 2023

Copy link
Copy Markdown

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

Starting in OpenSSL 3.2, RSA PKCS#1 v1.5 decryption no longer fails for invalid RSA padding. Instead, it produces random output data. This was introduced in openssl/openssl#13817.

Some Linux distributions back ported this to OpenSSL 3.1.x which resulted in failures seen in #95115.

This disables the "implicit rejection" of PKCS#1 v1.5 RSA decryption so that RSA.Encrypt and RSA.Decrypt continue to follow their documented behavior and cross-platform behavior.

Fixes #95115.

Author: vcsjones
Assignees: -
Labels:

area-System.Security
Milestone: -

@vcsjones vcsjones requested a review from bartonjs November 23, 2023 02:26
@vcsjones

vcsjones commented Nov 23, 2023

Copy link
Copy Markdown
Member Author

/azp list

@azure-pipelines

This comment was marked as outdated.

Sign in to view
@vcsjones

vcsjones commented Nov 23, 2023

Copy link
Copy Markdown
Member Author

/azp run runtime-libraries-coreclr outerloop-linux

@azure-pipelines

azure-pipelines Bot commented Nov 23, 2023

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@build-analysis build-analysis Bot mentioned this pull request Nov 23, 2023
Closed
@vcsjones

vcsjones commented Nov 23, 2023

Copy link
Copy Markdown
Member Author

Decrypt_512_CekDoesNotDecrypt_FixedValue passed in outerloop. I think this is good to merge now, and open back ports.

@bartonjs

bartonjs commented Nov 24, 2023

Copy link
Copy Markdown
Member

The outerloop tests that failed look to be unrelated; and, notably, the one we're fixing didn't fail.

@bartonjs bartonjs merged commit c23d9fa into dotnet:main Nov 24, 2023
@vcsjones vcsjones deleted the rsa-implicit-encryption branch November 24, 2023 19:09
@vcsjones

vcsjones commented Nov 24, 2023

Copy link
Copy Markdown
Member Author

/backport to release/8.0-staging

@vcsjones

vcsjones commented Nov 24, 2023

Copy link
Copy Markdown
Member Author

/backport to release/7.0-staging

@github-actions

github-actions Bot commented Nov 24, 2023

Copy link
Copy Markdown
Contributor

Started backporting to release/8.0-staging: https://github.com/dotnet/runtime/actions/runs/6984746124

@github-actions

github-actions Bot commented Nov 24, 2023

Copy link
Copy Markdown
Contributor

Started backporting to release/7.0-staging: https://github.com/dotnet/runtime/actions/runs/6984747052

@vcsjones

vcsjones commented Nov 24, 2023

Copy link
Copy Markdown
Member Author

/backport to release/6.0-staging

@github-actions

github-actions Bot commented Nov 24, 2023

Copy link
Copy Markdown
Contributor

Started backporting to release/6.0-staging: https://github.com/dotnet/runtime/actions/runs/6984748090

This was referenced Nov 24, 2023
Merged
Merged
Merged
@tomato42

tomato42 commented Dec 6, 2023 •
edited
Loading

Copy link
Copy Markdown

This will make all users of the RSA PKCS#1v1.5 decryption API vulnerable!

The change in OpenSSL was introduced to protect users of OpenSSL against https://people.redhat.com/~hkario/marvin/

@github-actions github-actions Bot locked and limited conversation to collaborators Jan 6, 2024
@carlossanlop

carlossanlop commented Jan 16, 2024

Copy link
Copy Markdown
Contributor

The above feedback was addressed in detail by @GrabYourPitchforks here. All backports have been merged.

@bartonjs bartonjs added cryptographic-docs-impact Issues impacting cryptographic docs. Cleared and reused after documentation is updated each release. tracking This issue is tracking the completion of other related issues. labels Aug 15, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@bartonjs bartonjs bartonjs approved these changes

Assignees

@vcsjones vcsjones

Labels

area-System.Security cryptographic-docs-impact Issues impacting cryptographic docs. Cleared and reused after documentation is updated each release. tracking This issue is tracking the completion of other related issues.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

System.Security.Cryptography.Pkcs test Decrypt_512_CekDoesNotDecrypt_FixedValue fails on Fedora 38

4 participants

@vcsjones @bartonjs @tomato42 @carlossanlop