From c0d5c673542b3d517c33fe1a9ab26bcda1a5a95f Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Wed, 15 Apr 2020 11:05:41 +0200 Subject: sm,dirmngr: Restrict allowed parameters used with rsaPSS. * sm/certcheck.c (extract_pss_params): Check the used PSS params. * dirmngr/crlcache.c (finish_sig_check): Ditto. * dirmngr/validate.c (check_cert_sig): Ditto. -- GnuPG-bug-id: 4538 # ------------------------ >8 ------------------------ See https://www.metzdowd.com/pipermail/cryptography/2019-November/035449.html Signed-off-by: Werner Koch --- dirmngr/crlcache.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'dirmngr/crlcache.c') diff --git a/dirmngr/crlcache.c b/dirmngr/crlcache.c index 73944667d..131a0bd8d 100644 --- a/dirmngr/crlcache.c +++ b/dirmngr/crlcache.c @@ -1731,6 +1731,29 @@ finish_sig_check (ksba_crl_t crl, gcry_md_hd_t md, int algo, algo, hashalgo); return gpg_error (GPG_ERR_INV_CRL); } + /* Add some restrictions; see ../sm/certcheck.c for details. */ + switch (algo) + { + case GCRY_MD_SHA1: + case GCRY_MD_SHA256: + case GCRY_MD_SHA384: + case GCRY_MD_SHA512: + case GCRY_MD_SHA3_256: + case GCRY_MD_SHA3_384: + case GCRY_MD_SHA3_512: + break; + default: + log_error ("PSS hash algorithm '%s' rejected\n", + gcry_md_algo_name (algo)); + return gpg_error (GPG_ERR_DIGEST_ALGO); + } + + if (gcry_md_get_algo_dlen (algo) != saltlen) + { + log_error ("PSS hash algorithm '%s' rejected due to salt length %u\n", + gcry_md_algo_name (algo), saltlen); + return gpg_error (GPG_ERR_DIGEST_ALGO); + } } -- cgit v1.2.3