Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitdae8ce0

Browse files
committed
Fixsybrenstuvel#165:CVE-2020-25658 - Bleichenbacher-style timing oracle
Use as many constant-time comparisons as practical in the`rsa.pkcs1.decrypt` function.`cleartext.index(b'\x00', 2)` will still be non-constant-time. Thealternative would be to iterate over all the data byte by byte inPython, which is several orders of magnitude slower. Given that aperfect constant-time implementation is very hard or even impossible todo in Python [1], I chose the more performant option here.[1]:https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/
1 parent6f59ff0 commitdae8ce0

File tree

2 files changed

+13
-4
lines changed

2 files changed

+13
-4
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
#Python-RSA changelog
22

3+
##Version 4.7 - in development
4+
5+
- Fix#165:CVE-2020-25658 - Bleichenbacher-style timing oracle inPKCS#1 v1.5
6+
decryption code
7+
38

49
##Version 4.4 & 4.6 - released 2020-06-12
510

‎rsa/pkcs1.py

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
importos
3131
importsys
3232
importtyping
33+
fromhmacimportcompare_digest
3334

3435
from .importcommon,transform,core,key
3536

@@ -251,17 +252,20 @@ def decrypt(crypto: bytes, priv_key: key.PrivateKey) -> bytes:
251252
# Detect leading zeroes in the crypto. These are not reflected in the
252253
# encrypted value (as leading zeroes do not influence the value of an
253254
# integer). This fixes CVE-2020-13757.
254-
iflen(crypto)>blocksize:
255-
raiseDecryptionError('Decryption failed')
255+
crypto_len_bad=len(crypto)>blocksize
256256

257257
# If we can't find the cleartext marker, decryption failed.
258-
ifcleartext[0:2]!=b'\x00\x02':
259-
raiseDecryptionError('Decryption failed')
258+
cleartext_marker_bad=notcompare_digest(cleartext[:2],b'\x00\x02')
260259

261260
# Find the 00 separator between the padding and the message
262261
try:
263262
sep_idx=cleartext.index(b'\x00',2)
264263
exceptValueError:
264+
sep_idx=-1
265+
sep_idx_bad=sep_idx<0
266+
267+
anything_bad=crypto_len_bad|cleartext_marker_bad|sep_idx_bad
268+
ifanything_bad:
265269
raiseDecryptionError('Decryption failed')
266270

267271
returncleartext[sep_idx+1:]

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp