12 ms·
OpenSSL leaks RSA private key information into entropy subsystem
- X-Istence 13y agoHere is the patch: http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a8122270236898bf http://freshbsd.org/commit/openbsd/e5136d69ece4682e6167c8f4a...
- tptacek 13y agoWait, so the patch just IGNORES the case where the CSPRNG isn't initialized?
- throwaway2048 13y agoopenbsd is switching openssl to be entirely reliant on its system CSPRNG (/dev/random and/or arc4random (which amusingly enough now uses chacha20 not rc4), which as you frequently recommend, cannot block and functions relying on it cannot fail), all internal RNG functionality is beening ripped out. There will be no CSPRNG to initalize. API/ABI compat will be maintained by NOOPing the functionality.
- tptacek 13y agoThat makes a lot of sense. Thanks for the clarity.
- dlgeek 13y agoIf the call to BN_BLINDING_create_param() after that code fails, it will throw an error immediately after. I haven't checked the code for that function, but it probably returns error when it tries to use the CSPRNG.
- X-Istence 13y agoThe CSPRNG has been replaced with arc4random_buf() in the OpenBSD code, and thus can not fail.
- X-Istence 13y agoCause there is no CSPRNG anymore: http://freshbsd.org/commit/openbsd/58777eed1cff7c5b34cbc026278f730176a6dbc2 http://freshbsd.org/commit/openbsd/58777eed1cff7c5b34cbc0262... RAND_status() always returns 1.
- tptacek 13y agoI'm sure this is a good patch, but before you freak out, here's the line he's probably referring to: if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL) { /* if PRNG is not properly seeded, resort to secret * exponent as unpredictable seed */ RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0.0); } This line is equivalent to "if you are already totally and royally fucked, do something cosmetic to pretend otherwise". The line occurs during the setup for RSA blinding, which is the only point in the core RSA code (outside keygen) that requires randomness --- blinding mixes a random integer into the otherwise deterministic RSA operation, to foil timing analysis. The code should probably abort when that condition happens. I think, at first glance, that the condition never really happens on normal systems.
- abus 13y agoThat is the code that was removed. It was removed entirely. No error handling was added to replace it. I would hope it will error or pause elsewhere if there is not enough random data though.
- tptacek 13y agoThat's bad. The condition should remain, but the RAND_ call should be replaced with an abort(). I doubt crappy randomness is much of an issue for RSA blinding, but it's a dealbreaker for other crypto operations.
- X-Istence 13y agoRAND_status() can never return 0 in the new OpenBSD code. All of the OpenSSL PRNG has been removed, and arc4random_buf() is used instead. This means that this particular piece of code could NEVER be hit because there is never a time that RAND_status() is going to return 0! i.e. This is unreachable code. On top of that RAND_add() is a no-op that won't do anything, since there is no way to add "seed" to the PRNG ... See this commit: http://freshbsd.org/commit/openbsd/58777eed1cff7c5b34cbc026278f730176a6dbc2 http://freshbsd.org/commit/openbsd/58777eed1cff7c5b34cbc0262...
- parfe 13y agoBrowsing other messages at the submitted link, did OpenBSD just start tearing apart the guts of OpenSSL since Heartbleed? Looks like OpenBSD lost all respect for the OpenSSL devs. "But apparently the OpenSSL guys could find no objects of lesser value to pass to the pluggable random subsystem, and had to resort to private keys and digests. Classy." "OPENSSL_DECLARE_EXIT serves no purpose." "OPENSSL_gmtime() is not a gmtime() wrapper. It is a gmtime_r(). Always trying to confuse people..." "Change library to use intrinsic memory allocation functions instead of OPENSSL_foo wrappers. This changes: OPENSSL_malloc->malloc OPENSSL_free->free OPENSSL_relloc->realloc OPENSSL_freeFunc->free"
- X-Istence 13y agoYep. It is even easier to see the carnage here: http://freshbsd.org/search?project=openbsd&q=file.name%3Alibssl http://freshbsd.org/search?project=openbsd&q=file.name%3Alib...