FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: reject dh,x25519,x448 in {Sign,Verify}Final · nodejs/node@6e7274f · GitHub

/ node Public

Commit 6e7274f

Browse files
JLHwung
authored and
richardlau
committed
crypto: reject dh,x25519,x448 in {Sign,Verify}Final
Fixes: #53742 PR-URL: #53774 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent d244204 commit 6e7274f

5 files changed

Lines changed: 69 additions & 13 deletions

File tree

‎src/crypto/crypto_sig.cc‎

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,15 @@ std::unique_ptr<BackingStore> Node_SignFinal(Environment* env,
9292
sig = ArrayBuffer::NewBackingStore(env->isolate(), sig_len);
9393
}
9494
EVPKeyCtxPointer pkctx(EVP_PKEY_CTX_new(pkey.get(), nullptr));
95-
if (pkctx &&
96-
EVP_PKEY_sign_init(pkctx.get()) &&
95+
if (pkctx && EVP_PKEY_sign_init(pkctx.get()) > 0 &&
9796
ApplyRSAOptions(pkey, pkctx.get(), padding, pss_salt_len) &&
98-
EVP_PKEY_CTX_set_signature_md(pkctx.get(), EVP_MD_CTX_md(mdctx.get())) &&
99-
EVP_PKEY_sign(pkctx.get(), static_cast<unsigned char*>(sig->Data()),
100-
&sig_len, m, m_len)) {
97+
EVP_PKEY_CTX_set_signature_md(pkctx.get(), EVP_MD_CTX_md(mdctx.get())) >
98+
0 &&
99+
EVP_PKEY_sign(pkctx.get(),
100+
static_cast<unsigned char*>(sig->Data()),
101+
&sig_len,
102+
m,
103+
m_len) > 0) {
101104
CHECK_LE(sig_len, sig->ByteLength());
102105
if (sig_len == 0)
103106
sig = ArrayBuffer::NewBackingStore(env->isolate(), 0);
@@ -526,14 +529,18 @@ SignBase::Error Verify::VerifyFinal(const ManagedEVPPKey& pkey,
526529
return kSignPublicKey;
527530

528531
EVPKeyCtxPointer pkctx(EVP_PKEY_CTX_new(pkey.get(), nullptr));
529-
if (pkctx &&
530-
EVP_PKEY_verify_init(pkctx.get()) > 0 &&
531-
ApplyRSAOptions(pkey, pkctx.get(), padding, saltlen) &&
532-
EVP_PKEY_CTX_set_signature_md(pkctx.get(),
533-
EVP_MD_CTX_md(mdctx.get())) > 0) {
534-
const unsigned char* s = sig.data<unsigned char>();
535-
const int r = EVP_PKEY_verify(pkctx.get(), s, sig.size(), m, m_len);
536-
*verify_result = r == 1;
532+
if (pkctx) {
533+
const int init_ret = EVP_PKEY_verify_init(pkctx.get());
534+
if (init_ret == -2) {
535+
return kSignPublicKey;
536+
}
537+
if (init_ret > 0 && ApplyRSAOptions(pkey, pkctx.get(), padding, saltlen) &&
538+
EVP_PKEY_CTX_set_signature_md(pkctx.get(), EVP_MD_CTX_md(mdctx.get())) >
539+
0) {
540+
const unsigned char* s = sig.data<unsigned char>();
541+
const int r = EVP_PKEY_verify(pkctx.get(), s, sig.size(), m, m_len);
542+
*verify_result = r == 1;
543+
}
537544
}
538545

539546
return kSignOk;

‎test/fixtures/keys/Makefile‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ all: \
2626
dh2048.pem \
2727
dh3072.pem \
2828
dherror.pem \
29+
dh_private.pem \
30+
dh_public.pem \
2931
dsa_params.pem \
3032
dsa_private.pem \
3133
dsa_private_encrypted.pem \
@@ -601,6 +603,12 @@ dh3072.pem:
601603
dherror.pem: dh1024.pem
602604
sed 's/^[^-].*/AAAAAAAAAA/g' dh1024.pem > dherror.pem
603605

606+
dh_private.pem:
607+
openssl genpkey -algorithm dh -out dh_private.pem -pkeyopt dh_param:ffdhe2048
608+
609+
dh_public.pem: dh_private.pem
610+
openssl pkey -in dh_private.pem -pubout -out dh_public.pem
611+
604612
dsa_params.pem:
605613
openssl dsaparam -out dsa_params.pem 2048
606614

‎test/fixtures/keys/dh_private.pem‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIBPgIBADCCARcGCSqGSIb3DQEDATCCAQgCggEBAP//////////rfhUWKK7Spqv
3+
3FYgJz088di5xYPOLTaVqeE2QRRkM/vMk53OJJs++X0v42NjDHXY9oGyAq7EYXrT
4+
3x7V1f1lYSQz9R9fBm7QhWNlVT3tGvO1VxNef1fJNZhPDHDg5ot34qaJ2vPv6HId
5+
8VihNq3nNTCsyk9IOnl6vAqxgrMk+2HRCKlLssjj+7lq2rdg1/RoHU9Co945TfSu
6+
Vu3nY3K7GQsHp8juCm1wngL84c334uzANATNKDQvYZFy/pzphYP/jk8SMu7ygYPD
7+
/jsbTG+tczu1/LwuwiAFxY7xg30Wg7LG80omwbLv+ohrQjhhKFyX//////////8C
8+
AQIEHgIcKNGyhQRxIhVXoyktdymwbN6MgXv85vPax+8eqQ==
9+
-----END PRIVATE KEY-----

‎test/fixtures/keys/dh_public.pem‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MIICJTCCARcGCSqGSIb3DQEDATCCAQgCggEBAP//////////rfhUWKK7Spqv3FYg
3+
Jz088di5xYPOLTaVqeE2QRRkM/vMk53OJJs++X0v42NjDHXY9oGyAq7EYXrT3x7V
4+
1f1lYSQz9R9fBm7QhWNlVT3tGvO1VxNef1fJNZhPDHDg5ot34qaJ2vPv6HId8Vih
5+
Nq3nNTCsyk9IOnl6vAqxgrMk+2HRCKlLssjj+7lq2rdg1/RoHU9Co945TfSuVu3n
6+
Y3K7GQsHp8juCm1wngL84c334uzANATNKDQvYZFy/pzphYP/jk8SMu7ygYPD/jsb
7+
TG+tczu1/LwuwiAFxY7xg30Wg7LG80omwbLv+ohrQjhhKFyX//////////8CAQID
8+
ggEGAAKCAQEA2whDVdYtNbr/isSFdw7rOSdbmcWrxiX6ppqDZ6yp8XjUj3/CEf/P
9+
60X7HndX+nXD7YaPtVZxktkIpArI7C+AH7fZxBduuv2eLnvYwK82jFHKe7zvfdMr
10+
26akMCV0kBA3ktgcftHlqYsIj52BaJlG37FRha3SDOL2yJOij3hNQhHCXTWLg7tP
11+
GtXmD202OoZ6Ll+LxBzBCFnxVauiKnzBGeawy4gDycUEHmq5oDRR68I2gmxmsLg5
12+
MQVAP5ljp+FEu4+TZm6hR4wQ5PRjCQ+teq+VqMro7EbbvZpn+X9kAgKSl2WDu0fT
13+
FbUnBn3HPBmUa/Fv/ooXrlckTUDjLkbWZQ==
14+
-----END PUBLIC KEY-----

‎test/parallel/test-crypto-sign-verify.js‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -794,3 +794,21 @@ assert.throws(
794794
}, { code: 'ERR_CRYPTO_UNSUPPORTED_OPERATION', message: 'Unsupported crypto operation' });
795795
}
796796
}
797+
798+
{
799+
// Dh, x25519 and x448 should not be used for signing/verifying
800+
// https://github.com/nodejs/node/issues/53742
801+
for (const algo of ['dh', 'x25519', 'x448']) {
802+
const privateKey = fixtures.readKey(`${algo}_private.pem`, 'ascii');
803+
const publicKey = fixtures.readKey(`${algo}_public.pem`, 'ascii');
804+
assert.throws(() => {
805+
crypto.createSign('SHA256').update('Test123').sign(privateKey);
806+
}, { code: 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE', message: /operation not supported for this keytype/ });
807+
assert.throws(() => {
808+
crypto.createVerify('SHA256').update('Test123').verify(privateKey, 'sig');
809+
}, { code: 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE', message: /operation not supported for this keytype/ });
810+
assert.throws(() => {
811+
crypto.createVerify('SHA256').update('Test123').verify(publicKey, 'sig');
812+
}, { code: 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE', message: /operation not supported for this keytype/ });
813+
}
814+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL