denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

curve25519: Prevent Ed25519 signature malleability

Browse Source 
As per RFC 8032, section 5.1.7 (and section 8.4) we have to make sure s, which
is the scalar in the second half of the signature value, is smaller than L.
Without that check, L can be added to most signatures at least once to create
another valid signature for the same public key and message.

This could be problematic if, for instance, a blacklist is based on hashes
of certificates.  A new certificate could be created with a different
signature (without knowing the signature key) by simply adding L to s.

Currently, both OpenSSL 1.1.1 and Botan 2.8.0 are vulnerable to this, which is
why the unit test currently only warns about it.
This commit is contained in:
Tobias Brunner
2018-11-30 15:35:01 +01:00
parent 69756c0bff
commit 2571898d32
2 changed files with 42 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/curve25519/curve25519_public_key.c
+21
View File
@@ -49,6 +49,13 @@ METHOD(public_key_t, get_type, key_type_t,
return KEY_ED25519;
}
/* L = 2^252+27742317777372353535851937790883648493 in little-endian form */
static chunk_t curve25519_order = chunk_from_chars(
0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58,
0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10);
METHOD(public_key_t, verify, bool,
private_curve25519_public_key_t *this, signature_scheme_t scheme,
void *params, chunk_t data, chunk_t signature)
@@ -94,6 +101,20 @@ METHOD(public_key_t, verify, bool,
{
return FALSE;
}
/* make sure 0 <= s < L, as per RFC 8032, section 5.1.7 to prevent signature
* malleability. Due to the three-bit check above (forces s < 2^253) there
* is not that much room, but adding L once works with most signatures */
for (i = 31; ; i--)
{
if (sig[i+32] < curve25519_order.ptr[i])
{
break;
}
else if (sig[i+32] > curve25519_order.ptr[i] || i == 0)
{
return FALSE;
}
}
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA512);
if (!hasher)