crypto/tls: TLSv1.3 connection fails with invalid PSK binder #59424

tsaarni · 2023-04-04T08:06:23Z

What version of Go are you using (`go version`)?

The bug impacts following versions

Go1.19.6 or later
Go1.20.1 or later

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (`go env`)?

The bug is not OS dependent

What did you do?

I have written TLSv1.3 client and server written in go.
In the server I have set CurvePreferences with non-default list of curves.
In the client I'm using default list of curves.
In the client I have enabled TLS session resumption by setting ClientSessionCache

What did you expect to see?

When the client establishes second TLS session, I expected the TLS handshake to succeed.

What did you see instead?

When the client establishes second TLS session, the server will reject it with alert invalid PSK binder.

The text was updated successfully, but these errors were encountered:

tsaarni · 2023-04-04T08:11:58Z

I'm attaching reproduction case. Here is the failure when running it

$ go run reproduce-tls-resumption-failure.go
Client: sending request to https://localhost:8443
Server: received request from 127.0.0.1:56926
Client: received response from server with status: 200 OK
Client: sleeping 5 sec...
Client: sending request to https://localhost:8443
2023/04/04 11:10:13 http: TLS handshake error from 127.0.0.1:56934: tls: invalid PSK binder
panic: Get "https://localhost:8443": remote error: tls: error decrypting message

The example code is here:

reproduce-tls-resumption-failure.go.txt

Same code is uploaded to https://goplay.tools/snippet/ur5TpD7hXe4

gopherbot · 2023-04-04T08:23:58Z

Change https://go.dev/cl/481955 mentions this issue: crypto/tls: fix PSK binder calculation

tsaarni · 2023-04-04T08:46:27Z

Hi @rolandshoemaker 👋 I may have bumped into a bug that was introduced with #58001. I submitted a proposal for a fix here #59425. I'd greatly appreciate it if you had an opportunity to take a look. Thank you!

mknyszek · 2023-04-04T14:15:34Z

CC @golang/security

tsaarni · 2023-04-04T15:03:36Z

Here is a summary how the bug gets triggered:

The bug is in TLSv1.3 handshake code and only impacts TLSv1.3 clients. Servers are not impacted. TLSv1.2 implementation is not impacted.

The bug was introduced by #58001

For the client to be impacted, client must have explicitly enabled TLS resumption by setting e.g. ClientSessionCache: tls.NewLRUClientSessionCache(num) in client's tls.Config structure. Client also needs to hold the SSL context and re-use it for multiple requests to trigger resumption

The bug happens in PSK resumption if client and server having incompatible preferred EC curve. For example, it can happen when the server has set CurvePreferences: []tls.CurveID{tls.CurveP521, tls.CurveP384, tls.CurveP256} in tls.Config but client uses the Go default list. Client will send ClientHello with x25519 but if server preferences does not include x25519, server will respond with HelloRetryRequest according to the spec (link) and set secp512r1 from server's CurvePreferences.

The reception of HelloRetryRequest response from the server will trigger the bug in client when above conditions are true. There is a typo in processHelloRetryRequest() which causes ClientHello message to be sent to server with invalid PSK binders hash. When server will process the new ClientHello with invalid PSK binders field, it will abort the handshake with invalid PSK binder alert.

rolandshoemaker · 2023-04-11T11:12:22Z

Sorry, I was out on vacation. Thanks for catching this!

@gopherbot please open backport issues for this, it's a regression from a security fix.

gopherbot · 2023-04-11T11:12:53Z

Backport issue(s) opened: #59539 (for 1.19), #59540 (for 1.20).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

When server and client have mismatch in curve preference, the server will send HelloRetryRequest during TLSv1.3 PSK resumption. There was a bug introduced by Go1.19.6 or later and Go1.20.1 or later, that makes the client calculate the PSK binder hash incorrectly. Server will reject the TLS handshake by sending alert: invalid PSK binder. Fixes golang#59424

gopherbot · 2023-04-24T13:38:04Z

Change https://go.dev/cl/488055 mentions this issue: [release-branch.go1.20] crypto/tls: fix PSK binder calculation

gopherbot · 2023-04-24T13:40:07Z

Change https://go.dev/cl/488075 mentions this issue: [release-branch.go1.19] crypto/tls: fix PSK binder calculation

When server and client have mismatch in curve preference, the server will send HelloRetryRequest during TLSv1.3 PSK resumption. There was a bug introduced by Go1.19.6 or later and Go1.20.1 or later, that makes the client calculate the PSK binder hash incorrectly. Server will reject the TLS handshake by sending alert: invalid PSK binder. For #59424. Fixes #59539. Change-Id: I2ca8948474275740a36d991c057b62a13392dbb9 GitHub-Last-Rev: 1aad9bc GitHub-Pull-Request: #59425 Reviewed-on: https://go-review.googlesource.com/c/go/+/481955 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> (cherry picked from commit 2c70690) Reviewed-on: https://go-review.googlesource.com/c/go/+/488075 Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>

When server and client have mismatch in curve preference, the server will send HelloRetryRequest during TLSv1.3 PSK resumption. There was a bug introduced by Go1.19.6 or later and Go1.20.1 or later, that makes the client calculate the PSK binder hash incorrectly. Server will reject the TLS handshake by sending alert: invalid PSK binder. For #59424. Fixes #59540. Change-Id: I2ca8948474275740a36d991c057b62a13392dbb9 GitHub-Last-Rev: 1aad9bc GitHub-Pull-Request: #59425 Reviewed-on: https://go-review.googlesource.com/c/go/+/481955 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> (cherry picked from commit 2c70690) Reviewed-on: https://go-review.googlesource.com/c/go/+/488055 Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>

When server and client have mismatch in curve preference, the server will send HelloRetryRequest during TLSv1.3 PSK resumption. There was a bug introduced by Go1.19.6 or later and Go1.20.1 or later, that makes the client calculate the PSK binder hash incorrectly. Server will reject the TLS handshake by sending alert: invalid PSK binder. For golang#59424. Fixes golang#59540. Change-Id: I2ca8948474275740a36d991c057b62a13392dbb9 GitHub-Last-Rev: 1aad9bc GitHub-Pull-Request: golang#59425 Reviewed-on: https://go-review.googlesource.com/c/go/+/481955 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> (cherry picked from commit 2c70690) Reviewed-on: https://go-review.googlesource.com/c/go/+/488055 Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>

tsaarni mentioned this issue Apr 4, 2023

crypto/tls: fix PSK binder calculation #59425

Closed

mknyszek added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Apr 4, 2023

mknyszek added this to the Backlog milestone Apr 4, 2023

This was referenced Apr 11, 2023

crypto/tls: TLSv1.3 connection fails with invalid PSK binder [1.19 backport] #59539

Closed

crypto/tls: TLSv1.3 connection fails with invalid PSK binder [1.20 backport] #59540

Closed

dmitshur modified the milestones: Backlog, Go1.21 Apr 22, 2023

dmitshur added NeedsFix The path to resolution is known, but the work has not been done. and removed NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Apr 22, 2023

gopherbot closed this as completed in 2c70690 Apr 24, 2023

golang locked and limited conversation to collaborators Apr 23, 2024

gopherbot added the FrozenDueToAge label Apr 23, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto/tls: TLSv1.3 connection fails with invalid PSK binder #59424

crypto/tls: TLSv1.3 connection fails with invalid PSK binder #59424

tsaarni commented Apr 4, 2023

tsaarni commented Apr 4, 2023 •

edited

gopherbot commented Apr 4, 2023

tsaarni commented Apr 4, 2023

mknyszek commented Apr 4, 2023

tsaarni commented Apr 4, 2023

rolandshoemaker commented Apr 11, 2023

gopherbot commented Apr 11, 2023

gopherbot commented Apr 24, 2023

gopherbot commented Apr 24, 2023

crypto/tls: TLSv1.3 connection fails with invalid PSK binder #59424

crypto/tls: TLSv1.3 connection fails with invalid PSK binder #59424

Comments

tsaarni commented Apr 4, 2023

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

tsaarni commented Apr 4, 2023 • edited

gopherbot commented Apr 4, 2023

tsaarni commented Apr 4, 2023

mknyszek commented Apr 4, 2023

tsaarni commented Apr 4, 2023

rolandshoemaker commented Apr 11, 2023

gopherbot commented Apr 11, 2023

gopherbot commented Apr 24, 2023

gopherbot commented Apr 24, 2023

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

tsaarni commented Apr 4, 2023 •

edited