psa_asymmetric_verify accepts RSA signatures with trailing garbage #258

New issue

Closed

opened 2019-09-12 15:00:25 -05:00 by gilles-peskine-arm · 1 comment

gilles-peskine-arm commented

2019-09-12 15:00:25 -05:00

(Migrated from github.com)

psa_asymmetric_verify with an RSA signature algorithm returns a success status not only if the provided signature is correct, but also if the provided signature consists of a correct signature followed by trailing junk.

This is of limited concern since it does not allow forgery attacks: there's no way to leverage this into getting a message accepted if the private key holder didn't sign it. However it violates the expectation that RSA PKCS#1v1.5 signatures are unique (if S1 and S2 are two valid signatures of the same message then S1 is bitwise identical to S2), and the expectation that a valid RSA signature (whatever the padding method) has a given size.

`psa_asymmetric_verify` with an RSA signature algorithm returns a success status not only if the provided signature is correct, but also if the provided signature consists of a correct signature followed by trailing junk. This is of limited concern since it does not allow forgery attacks: there's no way to leverage this into getting a message accepted if the private key holder didn't sign it. However it violates the expectation that RSA PKCS#1v1.5 signatures are unique (if S1 and S2 are two valid signatures of the same message then S1 is bitwise identical to S2), and the expectation that a valid RSA signature (whatever the padding method) has a given size.

ciarmcom commented

2019-09-12 15:47:54 -05:00

(Migrated from github.com)