Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

8272385: Enforce ECPrivateKey d value to be in the range [1, n-1] for SunEC provider #5324

Closed
wants to merge 3 commits into from

Conversation

jnimeh
Copy link
Member

@jnimeh jnimeh commented Sep 1, 2021

This fix adds an EC private key range check for the scalar value to be within the range [1, n-1] (n being the order of the generator) for the SunEC ECDSA Signature algorithms and ECDH KeyAgreement algorithms. While the SunEC KeyGenerator for EC keys will not generate private keys that sit outside the accepted range, it is possible to create and attempt to use ECPrivateKey objects that violate this range through a KeyFactory.

JBS: https://bugs.openjdk.java.net/browse/JDK-8272385


Progress

  • Change must not contain extraneous whitespace
  • Commit message must refer to an issue
  • Change must be properly reviewed

Issue

  • JDK-8272385: Enforce ECPrivateKey d value to be in the range [1, n-1] for SunEC provider

Reviewers

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.java.net/jdk pull/5324/head:pull/5324
$ git checkout pull/5324

Update a local copy of the PR:
$ git checkout pull/5324
$ git pull https://git.openjdk.java.net/jdk pull/5324/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 5324

View PR using the GUI difftool:
$ git pr show -t 5324

Using diff file

Download this PR as a diff file:
https://git.openjdk.java.net/jdk/pull/5324.diff

@bridgekeeper
Copy link

@bridgekeeper bridgekeeper bot commented Sep 1, 2021

👋 Welcome back jnimeh! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

@openjdk openjdk bot added the rfr label Sep 1, 2021
@openjdk
Copy link

@openjdk openjdk bot commented Sep 1, 2021

@jnimeh The following label will be automatically applied to this pull request:

  • security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

@openjdk openjdk bot added the security label Sep 1, 2021
@mlbridge
Copy link

@mlbridge mlbridge bot commented Sep 1, 2021

Webrevs

@wangweij
Copy link
Contributor

@wangweij wangweij commented Sep 1, 2021

So the key is only validated before it's used? Why not when creating it?

Do we need to validate public key as well? It might not be a problem since modular calculation should scale it back to normal. Our old native impl does have one at https://github.com/openjdk/jdk11u-dev/blob/master/src/jdk.crypto.ec/share/native/libsunec/impl/ec.c#L481.

One more thing: I would prefer [1, n) or (0, n) in the bug title, and, it's probably more efficient to call sVal.compareTo(BigInteger.ZERO) <= 0 than sVal.compareTo(BigInteger.ONE) < 0.

@jnimeh
Copy link
Member Author

@jnimeh jnimeh commented Sep 1, 2021

So the key is only validated before it's used? Why not when creating it?

Do we need to validate public key as well? It might not be a problem since modular calculation should scale it back to normal. Our old native impl does have one at https://github.com/openjdk/jdk11u-dev/blob/master/src/jdk.crypto.ec/share/native/libsunec/impl/ec.c#L481.

One more thing: I would prefer [1, n) or (0, n) in the bug title, and, it's probably more efficient to call sVal.compareTo(BigInteger.ZERO) <= 0 than sVal.compareTo(BigInteger.ONE) < 0.

Good questions.
WRT the KeyFactory, I looked not only at ours but also BC's and neither seems to put restrictions on ranges for an ECPrivateKey. Given that behavior I thought for this change I'd leave KeyFactory alone.

Validating the public key might not be a bad idea. I could come up with a Java-based version of what's in libsunec and update the test to cover that as well.

With respect to the synopsis, I'd prefer to leave it [1, n-1] because that's the notation used by FIPS 186-4, X9.62 and SEC 1. But the BigInteger.compareTo I will change as you suggested.

Copy link
Contributor

@ascarpino ascarpino left a comment

Looks good to me

@openjdk
Copy link

@openjdk openjdk bot commented Sep 1, 2021

@jnimeh This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8272385: Enforce ECPrivateKey d value to be in the range [1, n-1] for SunEC provider

Reviewed-by: ascarpino, weijun

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 21 new commits pushed to the master branch:

  • aaa6f69: 8273250: Address javadoc issues in Deflater::setDictionationary
  • 5ee5dd9: 8272914: Create hotspot:tier2 and hotspot:tier3 test groups
  • 5245c1c: 8273147: Update and restructure TestGCLogMessages log message list
  • 632a7e0: 8273165: GraphKit::combine_exception_states fails with "matching stack sizes" assert
  • c2e015c: 8273229: Update OS detection code to recognize Windows Server 2022
  • 0c1b16b: 8273243: Fix indentations in java.net.InetAddress methods
  • 152e669: 8273140: Replace usages of Enum.class.getEnumConstants() with Enum.values() where possible
  • 857a930: 8263375: Support stack watermarks in Zero VM
  • 6cfe314: 8272970: Parallelize runtime/InvocationTests/
  • a9a83b2: 8273256: runtime/cds/appcds/TestEpsilonGCWithCDS.java fails due to Unrecognized VM option 'ObjectAlignmentInBytes=64' on x86_32
  • ... and 11 more: https://git.openjdk.java.net/jdk/compare/2fce7cb4d21e4e2c234c22a1a150f7fe113d4d16...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

@openjdk openjdk bot added the ready label Sep 1, 2021
Copy link
Contributor

@wangweij wangweij left a comment

Looks fine. One nit: how about let checkPrivateKey returning the key like Objects.requireNonNull() does?

@jnimeh
Copy link
Member Author

@jnimeh jnimeh commented Sep 2, 2021

/integrate

@openjdk
Copy link

@openjdk openjdk bot commented Sep 2, 2021

Going to push as commit 29e0f13.
Since your change was applied there have been 21 commits pushed to the master branch:

  • aaa6f69: 8273250: Address javadoc issues in Deflater::setDictionationary
  • 5ee5dd9: 8272914: Create hotspot:tier2 and hotspot:tier3 test groups
  • 5245c1c: 8273147: Update and restructure TestGCLogMessages log message list
  • 632a7e0: 8273165: GraphKit::combine_exception_states fails with "matching stack sizes" assert
  • c2e015c: 8273229: Update OS detection code to recognize Windows Server 2022
  • 0c1b16b: 8273243: Fix indentations in java.net.InetAddress methods
  • 152e669: 8273140: Replace usages of Enum.class.getEnumConstants() with Enum.values() where possible
  • 857a930: 8263375: Support stack watermarks in Zero VM
  • 6cfe314: 8272970: Parallelize runtime/InvocationTests/
  • a9a83b2: 8273256: runtime/cds/appcds/TestEpsilonGCWithCDS.java fails due to Unrecognized VM option 'ObjectAlignmentInBytes=64' on x86_32
  • ... and 11 more: https://git.openjdk.java.net/jdk/compare/2fce7cb4d21e4e2c234c22a1a150f7fe113d4d16...master

Your commit was automatically rebased without conflicts.

@openjdk openjdk bot closed this Sep 2, 2021
@openjdk openjdk bot added integrated and removed ready rfr labels Sep 2, 2021
@openjdk
Copy link

@openjdk openjdk bot commented Sep 2, 2021

@jnimeh Pushed as commit 29e0f13.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

@jnimeh jnimeh deleted the JDK-8272385 branch Oct 19, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
integrated security
3 participants