mohammadmseet-hue
d37c95e27d
The PKCS#12 PBKDF iteration count is read directly from the input file with no upper bound. A crafted 83-byte .p12 file can set iterations to 2^31-1 (2147483647), causing Decode() to block a CPU core permanently. This change adds a maximum iteration limit of 1000000 in both verifyMac and pbDecrypterFor. Any file that specifies more iterations than this cap is rejected with an error. For reference, OpenSSL caps PBKDF2 at 10000000 iterations, and scrypt is bounded by its memory-hardness parameters. The 1000000 limit is generous for legitimate PKCS#12 files while still preventing denial of service. Fixes golang/go#78524 Change-Id: I1d12d6f5d90e347ca0dc113678abc51b0cff8d85 GitHub-Last-Rev: a0370d492dd4735cc7c1bb082b359ad79863fdae GitHub-Pull-Request: golang/crypto#343 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/759900 Reviewed-by: Daniel McCarney <daniel@binaryparadox.net> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
// Copyright 2015 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package pkcs12
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha1"
|
|
"crypto/x509/pkix"
|
|
"encoding/asn1"
|
|
)
|
|
|
|
type macData struct {
|
|
Mac digestInfo
|
|
MacSalt []byte
|
|
Iterations int `asn1:"optional,default:1"`
|
|
}
|
|
|
|
// from PKCS#7:
|
|
type digestInfo struct {
|
|
Algorithm pkix.AlgorithmIdentifier
|
|
Digest []byte
|
|
}
|
|
|
|
var (
|
|
oidSHA1 = asn1.ObjectIdentifier([]int{1, 3, 14, 3, 2, 26})
|
|
)
|
|
|
|
// maxIterations is a safety limit to prevent CPU exhaustion from
|
|
// crafted PKCS#12 files with unreasonable iteration counts.
|
|
const maxIterations = 1 << 20 // ~1 million
|
|
|
|
func verifyMac(macData *macData, message, password []byte) error {
|
|
if !macData.Mac.Algorithm.Algorithm.Equal(oidSHA1) {
|
|
return NotImplementedError("unknown digest algorithm: " + macData.Mac.Algorithm.Algorithm.String())
|
|
}
|
|
|
|
if macData.Iterations < 0 || macData.Iterations > maxIterations {
|
|
return NotImplementedError("iteration count is invalid or too high")
|
|
}
|
|
|
|
key := pbkdf(sha1Sum, 20, 64, macData.MacSalt, password, macData.Iterations, 3, 20)
|
|
|
|
mac := hmac.New(sha1.New, key)
|
|
mac.Write(message)
|
|
expectedMAC := mac.Sum(nil)
|
|
|
|
if !hmac.Equal(macData.Mac.Digest, expectedMAC) {
|
|
return ErrIncorrectPassword
|
|
}
|
|
return nil
|
|
}
|