openbsd/src/lib/libcrypto/dsa, branch OPENBSD_7_3_BASE

Fix an off-by-one in dsa_check_key()

2023-03-11T15:29:03+00:00

The private key is a random number in [1, q-1], so 1 must be allowed. Since q is at least an 160-bit prime and 2^159 + 1 is not prime (159 is not a power of 2), the probability that this is hit is < 2^-159, but a tiny little bit wrong is still wrong. Found while investigating a report by bluhm ok jsing

Call BN_free() instead of BN_clear_free().

2023-03-07T09:27:10+00:00

BN_clear_free() is a wrapper that calls BN_free() - call BN_free() directly instead. ok tb@

Simplify the consistency checks in old_dsa_priv_decode()

2023-03-04T21:42:49+00:00

We have long had expensive checks for DSA domain parameters in old_dsa_priv_decode(). These were implemented in a more complicated way than necesary. ok beck jsing

Cap the number of iterations in DSA signing

2023-03-04T21:30:23+00:00

The DSA standard specifies an infinite loop: if either r or s is zero in the signature calculation, a new random number k shall be generated and the whole thing is to be redone. The rationale is that, as the standard puts it, "[i]t is extremely unlikely that r = 0 or s = 0 if signatures are generated properly." The problem is... There is no cheap way to know that the DSA domain parameters we are handed are actually DSA domain parameters, so even if all our calculations are carefully done to do all the checks needed, we cannot know if we generate the signatures properly. For this we would need to do two primality checks as well as various congruences and divisibility properties. Doing this easily leads to DoS, so nobody does it. Unfortunately, it is relatively easy to generate parameters that pass all sorts of sanity checks and will always compute s = 0 since g is nilpotent. Thus, as unlikely as it is, if we are in the mathematical model, in practice it is very possible to ensure that s = 0. Read David Benjamin's glorious commit message for more information https://boringssl-review.googlesource.com/c/boringssl/+/57228 Thanks to Guido Vranken for reporting this issue, also thanks to Hanno Boeck who apparently found and reported similar problems earlier. ok beck jsing

Small readability tweak in old_dsa_priv_decode()

2023-03-04T21:08:14+00:00

Explicitly check against NULL and turn early return into goto err. ok beck jsing

Call dsa_check_keys() before signing or verifying

2023-03-04T21:06:17+00:00

We already had some checks on both sides, but they were less precise and differed between the functions. The code here is messy enough, so any simplification is helpful... ok beck jsing

Add dsa_check_key() calls on DSA decoding

2023-03-04T21:02:21+00:00

When decoding a public or a private key, use dsa_check_key() to ensure consistency of the DSA parameters. We do not always have sufficient information to do that, so this is not always possible. This adds new checks and replaces incomplete existing ones. On decoding the private key we will now only calculate the corresponding public key, if the sizes are sensible. This avoids potentially expensive operations. ok beck jsing

Provide dsa_check_key()

2023-03-04T20:54:52+00:00

This is a cheap check that ensures basid parameter consistency per FIPS 186-4: 1 < g < q, that q has the allowed bit sizes 160, 224, 256 and that p is neither too small nor too large. Unfortunately, enforcing the three allowed sizes for p is not possible since the default dsa key generation has not respected this limitation. Instead of checking that p and q are prime, we only check that they are odd. Check that public and private keys, if set, are in the proper range. In particular, disallow zero values. Various versions of these checks have been added to the dsa code over time. This consolidates and extends them and in a subsequent commit wewill replace the incomplete checks. BoringSSL has a similar function of the same name, thanks to David Benjamin for pointing it out. ok beck jsing

Provide DSA_R_INVALID_PARAMETERS error code

2023-03-04T20:47:04+00:00

This has been missing for a while already and will be used in a few upcoming commits. ok beck jsing

Merge dsa_sign.c and dsa_vrf.c into dsa_ossl.c

2023-02-13T09:21:35+00:00

discussed with jsing