On Sun, 31 Jul 2016 10:44:01 +0200 [email protected] (Niels Möller) wrote:
> Done now (or rather, added to the shared helper function > _rsa_check_size). I think this is incomplete. Looking at the patch: https://git.lysator.liu.se/nettle/nettle/commit/5eb30d94f6f5f3f0cb9ba9ed24bc52b7376176b6 You're only checking n (for both private and public keys), I could probably still craft a private key that crashes by choosing one of p or q to be even. > Any other easy checks for bogus keys that should be added? I would > expect that code parsing key formats, e.g., asn.1, would check sign > and range of parameters and catch bogus values early (e.g., the code > in nettle's der2rsa.c does that). It's possible to add additional > sanity checks to the _key_prepare functions, if desired. Depends on how far you want to go. Easy checks: * d, e must not be 0, 1, 2 More expensive checks: * Make sure n = p * q * p, q prime > It's not > entirely obvious where that responsibility should be placed. Yeah, I've been thinking a bit about it yesterday, I could still see problems with this approach. E.g. imagine someone does sanity checks with openssl and then assumes the key can be used with a nettle-based TLS stack. Even if we prevent it from crashing it may still prevent something from starting. I ended up wishing that there'd be a defined standard set of key sanity checks shared among implementations... but I'm probably just dreaming here... -- Hanno Böck https://hboeck.de/ mail/jabber: [email protected] GPG: BBB51E42
pgpvUTp7kv6SO.pgp
Description: OpenPGP digital signature
_______________________________________________ nettle-bugs mailing list [email protected] http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
