Encrypted private key is authenticated using an insecure two-byte hash #176

DenBond7 · 2021-09-07T20:57:15Z

@vanitasvitae Please look at the following issue FlowCrypt/flowcrypt-browser#3945.

After updating from 0.2.3 to 0.2.4 a user is not able to import a modified key(via PGPainless) to FlowCrypt for the browser. It seems something was changed in the encryption key process. I'm still doing the investigation. I will try to find a commit that causes the issue.

We use the following code

private fun changeKeyPassphrase(
    key: PGPSecretKeyRing,
    oldPassphrase: Passphrase,
    newPassphrase: Passphrase
  ): PGPSecretKeyRing {
    return encryptKey(decryptKey(key, oldPassphrase), newPassphrase)
  }

fun decryptKey(key: PGPSecretKeyRing, passphrase: Passphrase): PGPSecretKeyRing {
    return PGPainless.modifyKeyRing(key)
      .changePassphraseFromOldPassphrase(passphrase)
      .withSecureDefaultSettings()
      .toNoPassphrase()
      .done()
  }

private fun encryptKey(key: PGPSecretKeyRing, passphrase: Passphrase): PGPSecretKeyRing {
    return PGPainless.modifyKeyRing(key)
      .changePassphraseFromOldPassphrase(null)
      .withSecureDefaultSettings()
      .toNewPassphrase(passphrase)
      .done()
  }

The text was updated successfully, but these errors were encountered:

vanitasvitae · 2021-09-08T09:05:18Z

This could have to do with S2K parameters (KeyRingProtectionSettings), but this is just a wild guess.

DenBond7 · 2021-09-08T09:10:24Z

I think I'm very close to the answer. Need to check a few commits.

DenBond7 · 2021-09-08T09:32:20Z

After this commit we have the current issue.

vanitasvitae · 2021-09-08T09:47:19Z

I see.
This commit switches away from manually constructing the newly encrypted secret key via

        PGPDigestCalculator checksumCalculator = ImplementationFactory.getInstance()
                .getPGPDigestCalculator(defaultDigestHashAlgorithm);
        PBESecretKeyEncryptor encryptor = protector.getEncryptor(publicKey.getKeyID());
        // freshly locked key
        PGPSecretKey secretKey = new PGPSecretKey(privateKey, publicKey, checksumCalculator, publicKey.isMasterKey(), encryptor);

to using the supposedly better approach of relying on BC code:

        secretKey = PGPSecretKey.copyWithNewPassword(secretKey, decryptor, encryptor);

This method does a bunch of checks and additional logic depending on S2K usage and such. Perhaps there is an error in this method somewhere?

Btw: What exactly does the issue title mean? Is this an error message returned by FlowCrypt Browser? I can see that there is some checksum being calculated by BC.

DenBond7 · 2021-09-08T09:53:15Z

Btw: What exactly does the issue title mean? Is this an error message returned by FlowCrypt Browser? I can see that there is some checksum being calculated by BC.

@tomholub Could you provide more details here or point somebody from the team who can add more details from the code for FlowCrypt Browser?(maybe @rrrooommmaaa)

tomholub · 2021-09-08T10:01:18Z

Encrypted private key is authenticated using an insecure two-byte hash is an error thrown by OpenPGP.js when trying to use that key. @DenBond7 could you share a test key that you created where you could reproduce this?

DenBond7 · 2021-09-08T10:18:32Z

@DenBond7 could you share a test key that you created where you could reproduce this?

Key before the passphrase change

user: default@flowcrypt.test
passphrase: My super strong password 2018

Compatibility details:

(1) Primary keys found: 1  
(2) ----- Testing key 0 -----  
(3) PK 0 > Key type: openpgp  
(4) PK 0 > Is Private?: [-] true  
(5) PK 0 > User id 0: default@flowcrypt.test  
(6) PK 0 > Primary User: default@flowcrypt.test  
(7) PK 0 > Fingerprint: 3DEB E9F6 77D5 B9BB 38E5 A244 225F 8023 C20D 0957  
(8) PK 0 > Subkeys: [-] 1  
(9) PK 0 > Primary key algo: [-] eddsa  
(10) PK 0 > Usage flags: [-] [sign_data, certify_keys]  
(11) PK 0 > key decrypt: [-] INCORRECT PASSPHRASE  
(12) PK 0 > isFullyDecrypted: [-] false  
(13) PK 0 > isFullyEncrypted: [-] true  
(14) PK 0 > Primary key verify: [-] valid  
(15) PK 0 > Primary key creation?: [-] 1619704742 or 2021-04-29T13:59:02.000Z  
(16) PK 0 > Primary key expiration?: [-] -  
(17) PK 0 > Encrypt/Decrypt test: Encryption with key was successful:   
(18) PK 0 > Encrypt/Decrypt test: Skipping decryption because isPrivate:true isFullyDecrypted:false:   
(19) PK 0 > Sign/Verify test: [-] skipped, not fully decrypted  
(20) PK 0 > SK 0 > LongId: [-] 4F1458BD22B7BB53  
(21) PK 0 > SK 0 > Created: [-] 1619704742 or 2021-04-29T13:59:02.000Z  
(22) PK 0 > SK 0 > Algo: [-] ecdh  
(23) PK 0 > SK 0 > Usage flags: [-] [encrypt_communication, encrypt_storage]  
(24) PK 0 > SK 0 > Verify: [-] OK  
(25) PK 0 > SK 0 > Subkey tag: [-] 7  
(26) PK 0 > SK 0 > Subkey getBitSize: [-] undefined  
(27) PK 0 > SK 0 > Subkey decrypted: [-] false  
(28) PK 0 > SK 0 > Binding signature length: [-] 1  
(29) PK 0 > SK 0 > SIG 0 > Key flags: [-] 12  
(30) PK 0 > SK 0 > SIG 0 > Tag: [-] 2  
(31) PK 0 > SK 0 > SIG 0 > Version: [-] 4  
(32) PK 0 > SK 0 > SIG 0 > Public key algorithm: [-] 22  
(33) PK 0 > SK 0 > SIG 0 > Sig creation time: [-] 1619704742 or 2021-04-29T13:59:02.000Z  
(34) PK 0 > SK 0 > SIG 0 > Sig expiration time: [-] -  
(35) PK 0 > SK 0 > SIG 0 > Verified: [-] true  
(36) PK 0 > expiration: [-] undefined  
(37) PK 0 > internal dateBeforeExpiration: [-] undefined  
(38) PK 0 > internal usableForEncryptionButExpired: [-] false  
(39) PK 0 > internal usableForSigningButExpired: [-] false

Key after the passphrase change(causes the issue)

user: default@flowcrypt.test
passphrase: My super strong password 2021

Compatibility details:

(1) Primary keys found: 1  
(2) ----- Testing key 0 -----  
(3) PK 0 > Key type: openpgp  
(4) PK 0 > Is Private?: [-] true  
(5) PK 0 > User id 0: default@flowcrypt.test  
(6) PK 0 > Primary User: default@flowcrypt.test  
(7) PK 0 > Fingerprint: 3DEB E9F6 77D5 B9BB 38E5 A244 225F 8023 C20D 0957  
(8) PK 0 > Subkeys: [-] 1  
(9) PK 0 > Primary key algo: [-] eddsa  
(10) PK 0 > Usage flags: [-] [sign_data, certify_keys]  
(11) PK 0 > key decrypt: [Error: Encrypted private key is authenticated using an insecure two-byte hash]  
(12) PK 0 > isFullyDecrypted: [-] false  
(13) PK 0 > isFullyEncrypted: [-] true  
(14) PK 0 > Primary key verify: [-] valid  
(15) PK 0 > Primary key creation?: [-] 1619704742 or 2021-04-29T13:59:02.000Z  
(16) PK 0 > Primary key expiration?: [-] -  
(17) PK 0 > Encrypt/Decrypt test: Encryption with key was successful:   
(18) PK 0 > Encrypt/Decrypt test: Skipping decryption because isPrivate:true isFullyDecrypted:false:   
(19) PK 0 > Sign/Verify test: [-] skipped, not fully decrypted  
(20) PK 0 > SK 0 > LongId: [-] 4F1458BD22B7BB53  
(21) PK 0 > SK 0 > Created: [-] 1619704742 or 2021-04-29T13:59:02.000Z  
(22) PK 0 > SK 0 > Algo: [-] ecdh  
(23) PK 0 > SK 0 > Usage flags: [-] [encrypt_communication, encrypt_storage]  
(24) PK 0 > SK 0 > Verify: [-] OK  
(25) PK 0 > SK 0 > Subkey tag: [-] 7  
(26) PK 0 > SK 0 > Subkey getBitSize: [-] undefined  
(27) PK 0 > SK 0 > Subkey decrypted: [-] false  
(28) PK 0 > SK 0 > Binding signature length: [-] 1  
(29) PK 0 > SK 0 > SIG 0 > Key flags: [-] 12  
(30) PK 0 > SK 0 > SIG 0 > Tag: [-] 2  
(31) PK 0 > SK 0 > SIG 0 > Version: [-] 4  
(32) PK 0 > SK 0 > SIG 0 > Public key algorithm: [-] 22  
(33) PK 0 > SK 0 > SIG 0 > Sig creation time: [-] 1619704742 or 2021-04-29T13:59:02.000Z  
(34) PK 0 > SK 0 > SIG 0 > Sig expiration time: [-] -  
(35) PK 0 > SK 0 > SIG 0 > Verified: [-] true  
(36) PK 0 > expiration: [-] undefined  
(37) PK 0 > internal dateBeforeExpiration: [-] undefined  
(38) PK 0 > internal usableForEncryptionButExpired: [-] false  
(39) PK 0 > internal usableForSigningButExpired: [-] false

vanitasvitae · 2021-09-08T10:28:51Z

I did some debugging:

Before:
2476839211144907095
S2K Usage: 254
HashAlgo: SHA1
Iter count: 65536
IV: [55, 80, -61, 4, 5, 69, 43, -104]
Type: 3
Protection Mode: -1
5698276997885049683
S2K Usage: 254
HashAlgo: SHA1
Iter count: 65536
IV: [78, -91, -118, 30, 69, 32, 71, -46]
Type: 3
Protection Mode: -1
After:
2476839211144907095
S2K Usage: 255
HashAlgo: SHA1
Iter count: 65536
IV: [124, 122, -13, -61, -68, 69, -127, -14]
Type: 3
Protection Mode: -1
5698276997885049683
S2K Usage: 255
HashAlgo: SHA1
Iter count: 65536
IV: [-13, 111, -43, -9, 8, 116, -16, 56]
Type: 3
Protection Mode: -1

Note that the "after" key has a different S2K usage value.
~~Previously~~ it was CHECKSUM (0xff=255), ~~afterwards~~ it is SHA1 (0xfe=254).
This appears to be the cause of the issue.

Now to find out how this comes to be :D

vanitasvitae · 2021-09-08T10:41:53Z

I suppose that this line is the cause for the issue:
https://github.com/bcgit/bc-java/blob/bc3b92f1f0e78b82e2584c5fb4b226a13e7f8b3b/pg/src/main/java/org/bouncycastle/openpgp/PGPSecretKey.java#L815-L818

            if (s2kUsage == SecretKeyPacket.USAGE_NONE)
            {
                s2kUsage = SecretKeyPacket.USAGE_CHECKSUM;
            }

Since in your example code, you are doing a two step passphrase change (old -> none -> new), the S2K usage is set to none and then to CHECKSUM (which is insecure apparently).

I suppose, BC should set the S2K usage to SHA1 instead in that line.
You can however work around this in your code as well by calling PGPainless like this:

private fun changeKeyPassphrase(
    key: PGPSecretKeyRing,
    oldPassphrase: Passphrase,
    newPassphrase: Passphrase
  ): PGPSecretKeyRing {
    return PGPainless.modifyKeyRing(key)
      .changePassphraseFromOldPassphrase(oldPassphrase)
      .withSecureDefaultSettings()
      .toNewPassphrase(newPassphrase)
      .done()
  }

saving the intermediate step.

DenBond7 · 2021-09-08T10:44:25Z

You can however work around this in your code as well by calling PGPainless like this

Thank you! I will check

vanitasvitae · 2021-09-08T10:44:36Z

This is what I get when I change the passphrase directly:

Before:
2476839211144907095
S2K Usage: USAGE_SHA1
HashAlgo: SHA1
Iter count: 65536
IV: [55, 80, -61, 4, 5, 69, 43, -104]
Type: 3
Protection Mode: -1
5698276997885049683
S2K Usage: USAGE_SHA1
HashAlgo: SHA1
Iter count: 65536
IV: [78, -91, -118, 30, 69, 32, 71, -46]
Type: 3
Protection Mode: -1
After:
2476839211144907095
S2K Usage: USAGE_SHA1
HashAlgo: SHA1
Iter count: 65536
IV: [36, -96, -119, 107, 91, 50, -31, 95]
Type: 3
Protection Mode: -1
5698276997885049683
S2K Usage: USAGE_SHA1
HashAlgo: SHA1
Iter count: 65536
IV: [-3, 125, -48, 87, 115, 81, -72, 47]
Type: 3
Protection Mode: -1

vanitasvitae · 2021-09-08T10:45:43Z

I will ask upstream what the reason for USAGE_CHECKSUM is and if we can change to USAGE_SHA1 by default instead for when changing from unprotected to passphrase protected keys.

vanitasvitae · 2021-09-08T11:01:29Z

I created bcgit/bc-java#1020 upstream.

DenBond7 · 2021-09-08T12:23:25Z

You can however work around this in your code as well by calling PGPainless like this:

I confirm that it fixes the issue. @vanitasvitae Please close it if needed. Thank you!

tomholub · 2021-09-08T13:40:50Z

By the way, is there some better option than USAGE_SHA1? Using a more secure hash? Or is that already the most secure option available?

vanitasvitae · 2021-09-08T13:54:18Z

I think for version 4 keys (which is what BC currently supports), USAGE_SHA1 is the best option.
For the upcoming version 5 keys, the current draft of the spec briefly mentions a new usage type (253) which supposedly makes use of AEAD. This would be the favourable option, but it is not yet available (and I'm not sure if the spec is stable enough already for implementations to emerge).

Edit: RFC4880bis

vanitasvitae added bug Something isn't working module: core Issue affects the core module labels Sep 8, 2021

vanitasvitae added the upstream Issue is caused by an upstream package label Sep 8, 2021

DenBond7 mentioned this issue Sep 8, 2021

PGPainless usage. Fix changing passphrase FlowCrypt/flowcrypt-android#1448

Closed

vanitasvitae closed this as completed Sep 8, 2021

IvanPizhenko mentioned this issue Sep 8, 2021

Fixed changing passphrase via PGPainless.| #1448 FlowCrypt/flowcrypt-android#1449

Merged

4 tasks

DenBond7 mentioned this issue Sep 8, 2021

Change passphrase. Automatically change to a secure method if the key already uses insecure method #178

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Encrypted private key is authenticated using an insecure two-byte hash #176

Encrypted private key is authenticated using an insecure two-byte hash #176

DenBond7 commented Sep 7, 2021 •

edited

Loading

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

tomholub commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021 •

edited

Loading

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

tomholub commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021 •

edited

Loading

Encrypted private key is authenticated using an insecure two-byte hash #176

Encrypted private key is authenticated using an insecure two-byte hash #176

Comments

DenBond7 commented Sep 7, 2021 • edited Loading

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

tomholub commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

Key before the passphrase change

Key after the passphrase change(causes the issue)

vanitasvitae commented Sep 8, 2021 • edited Loading

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021

DenBond7 commented Sep 8, 2021

tomholub commented Sep 8, 2021

vanitasvitae commented Sep 8, 2021 • edited Loading

DenBond7 commented Sep 7, 2021 •

edited

Loading

vanitasvitae commented Sep 8, 2021 •

edited

Loading

vanitasvitae commented Sep 8, 2021 •

edited

Loading