crypto v0.10.29: Diffie-Hellman generated public key is missing a byte from time to time.

[johnnycrab]

Hi :)

I have encountered something weird when using the crypto module's Diffie-Hellman feature. Obviously the modp14 group should return 2048 bit numbers, however from time to time, the generated public key is missing a byte and the length is merely 255 bytes.

EDIT: Please check comment below, the issue can appear in all Diffie Hellman exchange objects, not only in group modp14.

Here is a short snippet that reproduces the behaviour:

crypto = require('crypto');

var iterations = 0;

var create = function () {

    iterations++;

    var dh = crypto.getDiffieHellman('modp14');
    var publicKey = dh.generateKeys();

    if (publicKey.length === 255) {
        console.log('Diffie bad length! Iterations: ' + iterations);
        iterations = 0;
        setTimeout(function () {
            create();
        }, 5);
    }
    else {
        setTimeout(function () {
            create();
        }, 5);
    }
};

create();

On node v.0.10.29 this can output:

Diffie bad length! Iterations: 1056
Diffie bad length! Iterations: 82
Diffie bad length! Iterations: 114
Diffie bad length! Iterations: 720
(...)

And so on and so on. I haven't found any related issue, so I thought maybe someone has a clue on what is going on there? Is it node? Is it OpenSSL?

Thanks in advance!

EDIT: Same behaviour on v0.11.13

[joernroeder]

I have the same behaviour on v0.10.28…

Diffie bad length! Iterations: 28
Diffie bad length! Iterations: 203
Diffie bad length! Iterations: 507
Diffie bad length! Iterations: 226
Diffie bad length! Iterations: 321
Diffie bad length! Iterations: 91
Diffie bad length! Iterations: 369
Diffie bad length! Iterations: 212
Diffie bad length! Iterations: 11
Diffie bad length! Iterations: 102
Diffie bad length! Iterations: 258

[johnnycrab]

Okay, I have tested all the other RFC groups + tested it when generating a prime manually and using crypto.createDiffieHellman(prime). The issue comes up every time: On some iterations, one byte is missing.

The next step would be to step directly into the OpenSSL wrapper, I haven't done this yet.

In my opinion this is a very severe issue: it easily breaks the generation of the secret and all following key derivations, making it a mess to debug (I have experienced this myself ;) ), as when the other side is expecting 256 bytes (or whatever length), the last byte is read from basically wherever.

[indutny]

@johnnycrab do you expect it to be padded or what? The key itself could have various size, it all depends on the result of the exponentiation and reduction.

[indutny]

Another question, does node.js crypto API accept such keys? If it does - I don't see any bug here.

[johnnycrab]

@indutny I am aware the key size can vary, however i thought it would be padded or else stated otherwise in the docs. Thus the fault is on my side, sorry.

[indutny]

You could always submit a PR for docs! ;) Cheers!