Fix rsaz 512 overflow bug #10574

bernd-edlinger · 2019-12-04T22:07:13Z

Fix for CVE-2019-1551, master branch

Checklist

documentation is added or updated
tests are added or updated

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. CVE-2019-1551

We have always a carry in %rcx or %rbx in range 0..2 from the previous stage, that is added to the result of the 64-bit square, but the low nibble of any square can only be 0, 1, 4, 9. Therefore one "adcq $0, %rdx" can be removed. Likewise in the ADX code we can remove one "adcx %rbp, $out" since %rbp is always 0, and carry is also zero, therefore that is a no-op.

CI failures are relevant :(

paulidale · 2019-12-04T22:24:23Z

Adding cross references.
1.1.1 fix in: #10575
1.0.2 fix in: #10576

bernd-edlinger · 2019-12-04T22:29:46Z

The first two test vectors were found by the OSS-Fuzz project.
The other fest vectors were created using sage:

sage: factor(2^127-4)
2^2 * 31 * 601 * 1801 * 269089806001 * 4710883168879506001
sage: hex(4710883168879506001)
'41606b48636df251'
sage: hex((2^127-4)//4710883168879506001)
'1f53803baebfda53c'
sage: hex(0x41606b48636df251*0x1f53803baebfda53c)
'7ffffffffffffffffffffffffffffffc'
test case 1:

sage: R=2^512                                                                                                              
sage: n=next_prime(2^511)
sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0x41606b48636df251 + 0x1f53803baebfda53c*2^64))                                               
sage: X
5148719036160389201525610950887605325980251964889646556085286545393154880917882341316935963597876203651239711308098807067785803336463909753993540214027190
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 2:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0x41606b48636df251*2^64 + 0x1f53803baebfda53c*2^128))
sage: X
890834085435375257741967877133046082794237143485305415862263654481513601097228909494719125666494654362966596010917307450870141892672764191218875181826063
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 3:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0x41606b48636df251*2^128 + 0x1f53803baebfda53c*2^192))
sage: X
3427446396505596330634350984901719674479522569002785244080234738428874363543574613629729936644454873653305371741673537907318534426985272974404612945608761
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 4:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0x41606b48636df251*2^192 + 0x1f53803baebfda53c*2^256))
sage: X
347274304491756456407885782611187456004533123731559738386965298569198700288908959884783511336015173659084450584054338327182069024088133164805266956353542
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 5:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0x41606b48636df251*2^256 + 0x1f53803baebfda53c*2^320))
sage: X
3608632990153469264412378349742339216742409743898601587274768025011077203298564355519276771734494617412284225520408258675349965114483434992887431333675068
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 6:

sage: X=Integer(IntegerModRing(n)(R)^-1*(0x41606b48636df251*2^320 + 0x1f53803baebfda53c*2^384))
sage: X
845537437023407024291050822694198152023570976726072321216526487786890643880175215245684343282644317726448025670286639629620257469283458217850119569539086
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

sage: factor(2^127-2)
2 * 3^3 * 7^2 * 19 * 43 * 73 * 127 * 337 * 5419 * 92737 * 649657 * 77158673929
sage: hex(77158673929*3*3*3*19*43*73*127)
'dafc8d281b96bf25'
sage: hex((2^127-2)//0xdafc8d281b96bf25)
'95a2809f0d0176a6'
sage: hex(0x95a2809f0d0176a6 * 0xdafc8d281b96bf25)
'7ffffffffffffffffffffffffffffffe'

test case 7:

sage: n=next_prime(2^511+2^510)
sage: X=Integer(IntegerModRing(n)(R)^-1*(0x95a2809f0d0176a6*2^384 + 0xdafc8d281b96bf25*2^448))

sage: factor(2^128-1)
3 * 5 * 17 * 257 * 641 * 65537 * 274177 * 6700417 * 67280421310721
sage: hex(67280421310721*274177)
'10000000000000001'
sage: hex(3 * 5 * 17 * 257 * 641 * 65537 *6700417)
'ffffffffffffffff'
sage: hex(3 * 5 * 17 * 257 * 641 * 65537 *6700417)
'ffffffffffffffff'
sage: hex(0xffffffffffffffff * 0x10000000000000001)
'ffffffffffffffffffffffffffffffff'


test case 8:
sage: n=next_prime(2^511)
sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0xffffffffffffffff + 0x10000000000000001*2^64))
sage: X
3155666506033786929967309937640790361084670559125912405342594979434514281852895628549089784140633802237856597253350882057776006558494345853302083699912572
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 9:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0xffffffffffffffff*2^64 + 0x10000000000000001*2^128))
sage: X
3789819583801342198190405714582958759005991915505282362397087750421354472464482309884313568513392719866881818533879437723959004941019388529192775771488319
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 10:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0xffffffffffffffff*2^128 + 0x10000000000000001*2^192))
sage: X
4695752552040706867080542538786056470322165281761525158189220280402554744766748475920074276424690564764466205012296891227919906548065034299166336940507214
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 11:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0xffffffffffffffff*2^192 + 0x10000000000000001*2^256))
sage: X
2159140240970485794188159431017382878636879856244045329971239574891969113356066116282803432319645738605981983280459398974026896474502911811812651475927076
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 12:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0xffffffffffffffff*2^256 + 0x10000000000000001*2^320))
sage: X
5239312332984325668414624633307915097111691815000872662334695514543653352139236244355716342933680820813722132244478049043787190399972784701334569424519255
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 13:

sage: X=Integer(IntegerModRing(n)(R)^-1*(2^510 + 0xffffffffffffffff*2^320 + 0x10000000000000001*2^384))
sage: X
1977953647322612860406858017869125467496941904523063466791308891117279673905853192947053975836177456987550529342885618109390409133788264851714311303725089
sage: n-1
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042158
sage: n
6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503042159
sage: pow(X,n-1,n)
1

test case 14:

sage: n=next_prime(2^512-2^64)
sage: X=Integer(IntegerModRing(n)(R)^-1 * (0xffffffffffffffff*2^448 + 0xfFFFFFFFFFFFFFFFF*2^380))
sage: X
6456987954117763835533395796948878140715006860263624787492985786851463021696673830592391568882152644949976371994399712030236821104813318117996225041943964
sage: n-1
13407807929942597099574024998205846127479365820592393377723561443721764030073546976801874298166903427690031858186486050853753882811946551499689575296532556
sage: n
13407807929942597099574024998205846127479365820592393377723561443721764030073546976801874298166903427690031858186486050853753882811946551499689575296532557
sage: pow(X,n-1,n)
1

bernd-edlinger · 2019-12-04T22:53:26Z

The string from the first test vector was too long to C90.
I made it shorter by modulo, which should not change the test.
For reference, the expected results were computed using sage:

first test:

sage: b=400000000000000000000000000000000000000000000000000000000000000000000000
....: 00000000000000000000000000000000000000000000000000000000000000000000000000
....: 00000000000000000000000000000000000000000000000000000000000000000000000000
....: 00000000000000000000000000000000000000000000000000000000000000000000000000
....: 00006000000000000000000000000000000000000000000000000000000000000000000000
....: 00000000000000000000000000000000000000000000000000000000000000000000000000
....: 00000000000000000000000000000000000000000000000000000000000000000000000000
....: 00000000000000000000000000000000000000000000000000000000000000000000000176
....: 079519223
sage: e=800000000000000000000000000000000000000000000000000000000000000000000000
....: 0000000000000000000000000000000000000000000000000000000000000000
sage: n=134078079268452372098073764561319176260439585561511786748331635432942763
....: 30515137663421134775482798690129946803802212663956180562088664022929883876
....: 655300863
sage: b%n
11661802380018791130421822926261696211062555589140005959993120844627946820899490684928760491249738643524880720584249698100907201002086675047927600340800371
sage: pow(b,e,n)
8243904058268085430037326628480645845409758077568738532059032482829411441589060359473015812042675626645792847533045025133977349826758407619521544102068438

second test:
sage: b=497427004141080382207886669615958694699587761898701021931284472602843861
....: 21835740784990869050050504348861513337232530490826340663197278031692737429
....: 054
sage: e=497427004141080382207886669615958694699587742818875499504114853916632433
....: 62592271353668158565195557417149981094324650322556843202946445882670777892
....: 608
sage: n=134078071651142022721559283097145248281537748262725172553709902844297694
....: 97230131760206012644403029349547320953206103351725462999947509743623340557
....: 059752191
sage: pow(b,e,n)
5296244594780707015616522701706118082963369547253192207884519362176786998494754269566542021902852281553955919479361968433490044249304558011362360473525933

bernd-edlinger · 2019-12-04T22:55:24Z

Hopefully the CI will work now.
But probably a change log entry is still missing.

paulidale · 2019-12-04T23:53:28Z

Travis is still unhappy...

[extended tests]

bernd-edlinger · 2019-12-05T10:56:50Z

Ah sorry, I forgot to push the CHANGES

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. CVE-2019-1551 Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from #10574)

We have always a carry in %rcx or %rbx in range 0..2 from the previous stage, that is added to the result of the 64-bit square, but the low nibble of any square can only be 0, 1, 4, 9. Therefore one "adcq $0, %rdx" can be removed. Likewise in the ADX code we can remove one "adcx %rbp, $out" since %rbp is always 0, and carry is also zero, therefore that is a no-op. Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from #10574)

[extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from #10574)

Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from #10574)

bernd-edlinger · 2019-12-06T12:43:01Z

Merged to master, thanks!

If one of more CVE id(s) are found in a commit message, those are added in the finding output. Example: "8c6f86c7c5350fadf22d32d6cd4712e2ad4447ba": { "message": "Fix an overflow bug in rsaz_512_sqr\n\nThere is an overflow bug in the x64_64 Montgomery squaring procedure used in\nexponentiation with 512-bit moduli. No EC algorithms are affected. Analysis\nsuggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a\nresult of this defect would be very difficult to perform and are not believed\nlikely. Attacks against DH512 are considered just feasible. However, for an\nattack the target would have to re-use the DH512 private key, which is not\nrecommended anyway. Also applications directly using the low level API\nBN_mod_exp may be affected if they use BN_FLG_CONSTTIME.\n\nCVE-2019-1551\n\nReviewed-by: Paul Dale <paul.dale@oracle.com>\nReviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>\n(Merged from openssl/openssl#10574", "commit-id": "8c6f86c7c5350fadf22d32d6cd4712e2ad4447ba", "summary": "Fix an overflow bug in rsaz_512_sqr", "stats": { "insertions": 197, "deletions": 184, "lines": 381, "files": 1 }, "author": "Andy Polyakov", "author-email": "appro@openssl.org", "authored_date": 1575460101, "committed_date": 1575635491, "branches": [ "master" ], "pattern-selected": "(?i)(denial of service |\bXXE\b|remote code execution|\bopen redirect|OSVDB|\bvuln|\bCVE\b |\bXSS\b|\bReDoS\b|\bNVD\b|malicious|x−frame−options|attack|cross site |exploit|malicious|directory traversal |\bRCE\b|\bdos\b|\bXSRF \b|\bXSS\b|clickjack|session.fixation|hijack|\badvisory|\binsecure |security |\bcross−origin\b|unauthori[z|s]ed |infinite loop)", "pattern-matches": [ "attack" ], "cve": [ "CVE-2019-1551" ], "state": "cve-assigned" } The state is also updated to cve-assigned if one or more CVE are present in the commit message.

Andy Polyakov and others added 2 commits December 4, 2019 12:48

bernd-edlinger added the branch: master Merge to master branch label Dec 4, 2019

paulidale previously approved these changes Dec 4, 2019

View reviewed changes

paulidale added the approval: done This pull request has the required number of approvals label Dec 4, 2019

This was referenced Dec 4, 2019

Fix rsaz 512 overflow bug [1.0.2] #10576

Closed

Fix rsaz 512 overflow bug [1.1.1] #10575

Closed

bernd-edlinger force-pushed the fix_rsaz_512_overflow_bug branch from 15d92c9 to 6f67704 Compare December 4, 2019 23:49

bernd-edlinger force-pushed the fix_rsaz_512_overflow_bug branch from 6f67704 to 08a107e Compare December 4, 2019 23:58

Add a test case for rsaz_512_sqr overflow handling

3e516cd

[extended tests]

bernd-edlinger force-pushed the fix_rsaz_512_overflow_bug branch from 08a107e to 3e516cd Compare December 5, 2019 00:17

Add a CHANGES entry for CVE-2019-1551

2ba77b4

paulidale added approval: omc review pending and removed approval: done This pull request has the required number of approvals labels Dec 5, 2019

paulidale approved these changes Dec 5, 2019

View reviewed changes

paulidale added approval: done This pull request has the required number of approvals approval: ready to merge The 24 hour grace period has passed, ready to merge and removed approval: omc review pending approval: done This pull request has the required number of approvals labels Dec 5, 2019

openssl-machine pushed a commit that referenced this pull request Dec 6, 2019

Add a test case for rsaz_512_sqr overflow handling

18d42d8

[extended tests] Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from #10574)

openssl-machine pushed a commit that referenced this pull request Dec 6, 2019

Add a CHANGES entry for CVE-2019-1551

4c3f748

Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from #10574)

bernd-edlinger closed this Dec 6, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix rsaz 512 overflow bug #10574

Fix rsaz 512 overflow bug #10574

bernd-edlinger commented Dec 4, 2019 •

edited

Loading

paulidale commented Dec 4, 2019

bernd-edlinger commented Dec 4, 2019

bernd-edlinger commented Dec 4, 2019

bernd-edlinger commented Dec 4, 2019

paulidale commented Dec 4, 2019

bernd-edlinger commented Dec 5, 2019

bernd-edlinger commented Dec 6, 2019

Fix rsaz 512 overflow bug #10574

Fix rsaz 512 overflow bug #10574

Conversation

bernd-edlinger commented Dec 4, 2019 • edited Loading

Checklist

paulidale commented Dec 4, 2019

bernd-edlinger commented Dec 4, 2019

bernd-edlinger commented Dec 4, 2019

bernd-edlinger commented Dec 4, 2019

paulidale commented Dec 4, 2019

bernd-edlinger commented Dec 5, 2019

bernd-edlinger commented Dec 6, 2019

bernd-edlinger commented Dec 4, 2019 •

edited

Loading