gh-Mbed-TLS/TF-PSA-Crypto

Watch

Fork 0

PKCS#5 PBES2: reject iteration counts below 1 and mismatching keyLength #918

Open

ManoharPaturi wants to merge 1 commit from ManoharPaturi/fix-pbes2-params-validation into development

ManoharPaturi commented

2026-09-29 10:57:22 -05:00

(Migrated from github.com)

Problem

pkcs5_parse_pbkdf2_params() accepts any iterationCount from the EncryptedPrivateKeyInfo, including zero, and the PBES2 path silently discards a mismatching keyLength:

iterationCount has no lower bound. RFC 8018 §4.2 requires at least 1. With iterationCount = 0 the PBKDF2 loop derives the key from a single HMAC block, so whoever supplies the encrypted key file chooses the KDF cost. Verified against current development: patching the iteration INTEGER of framework/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes128cbc.der from 2048 to 0 and calling mbedtls_pk_parse_key() runs the full decryption with the 0-iteration key (failing only later with PASSWORD_MISMATCH, i.e. the parameter was accepted and used).
keyLength is parsed then ignored ("we don't know if it was set or not"). RFC 8018 §A.2: when present it MUST equal the encryption key length. A hostile/misconfigured PBES2 parameter set is accepted instead of rejected.

Fix

Reject iterationCount < 1 with MBEDTLS_ERR_PKCS5_INVALID_FORMAT.
Use keylen == 0 as the "absent" sentinel (the declaration is zero-initialized and the ASN.1 getter only writes on success) and reject a present-but-mismatching keyLength.

Verification

Branch builds clean; the mutated-DER case above is now rejected at parse time. A test_suite_pkparse data entry with the modified DER makes this a regression test.

## Problem `pkcs5_parse_pbkdf2_params()` accepts any `iterationCount` from the EncryptedPrivateKeyInfo, including zero, and the PBES2 path silently discards a mismatching `keyLength`: 1. **`iterationCount` has no lower bound.** RFC 8018 §4.2 requires at least 1. With `iterationCount = 0` the PBKDF2 loop derives the key from a single HMAC block, so whoever supplies the encrypted key file chooses the KDF cost. Verified against current `development`: patching the iteration INTEGER of `framework/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes128cbc.der` from 2048 to 0 and calling `mbedtls_pk_parse_key()` runs the full decryption with the 0-iteration key (failing only later with `PASSWORD_MISMATCH`, i.e. the parameter was accepted and used). 2. **`keyLength` is parsed then ignored** ("we don't know if it was set or not"). RFC 8018 §A.2: when present it MUST equal the encryption key length. A hostile/misconfigured PBES2 parameter set is accepted instead of rejected. ## Fix - Reject `iterationCount < 1` with `MBEDTLS_ERR_PKCS5_INVALID_FORMAT`. - Use `keylen == 0` as the "absent" sentinel (the declaration is zero-initialized and the ASN.1 getter only writes on success) and reject a present-but-mismatching `keyLength`. ## Verification Branch builds clean; the mutated-DER case above is now rejected at parse time. A `test_suite_pkparse` data entry with the modified DER makes this a regression test.

copilot-pull-request-reviewer[bot] (Migrated from github.com) reviewed

2026-09-29 10:57:34 -05:00

copilot-pull-request-reviewer[bot] (Migrated from github.com) left a comment

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

This pull request is broken due to missing fork information.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'ManoharPaturi/fix-pbes2-params-validation:ManoharPaturi/fix-pbes2-params-validation'

git switch 'ManoharPaturi/fix-pbes2-params-validation'

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch 'development'

git merge --no-ff 'ManoharPaturi/fix-pbes2-params-validation'

git switch 'ManoharPaturi/fix-pbes2-params-validation'

git rebase 'development'

git switch 'development'

git merge --ff-only 'ManoharPaturi/fix-pbes2-params-validation'

git switch 'ManoharPaturi/fix-pbes2-params-validation'

git rebase 'development'

git switch 'development'

git merge --no-ff 'ManoharPaturi/fix-pbes2-params-validation'

git switch 'development'

git merge --squash 'ManoharPaturi/fix-pbes2-params-validation'

git switch 'development'

git merge --ff-only 'ManoharPaturi/fix-pbes2-params-validation'

git switch 'development'

git merge 'ManoharPaturi/fix-pbes2-params-validation'

git push origin 'development'

No reviewers

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto!918

No description provided.

Rows
Columns