From fe096903081d0f80d1327689ff5453ef156ded97 Mon Sep 17 00:00:00 2001 From: Clemens Lang Date: Thu, 17 Nov 2022 18:43:56 +0100 Subject: [PATCH] pbkdf2: Set minimum password length of 8 bytes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Implementation Guidance for FIPS 140-3 says in section D.N "Password-Based Key Derivation for Storage Applications" that "the vendor shall document in the module’s Security Policy the length of a password/passphrase used in key derivation and establish an upper bound for the probability of having this parameter guessed at random. This probability shall take into account not only the length of the password/passphrase, but also the difficulty of guessing it. The decision on the minimum length of a password used for key derivation is the vendor’s, but the vendor shall at a minimum informally justify the decision." We are choosing a minimum password length of 8 bytes, because NIST's ACVP testing uses passwords as short as 8 bytes, and requiring longer passwords combined with an implicit indicator (i.e., returning an error) would cause the module to fail ACVP testing. Signed-off-by: Clemens Lang Resolves: rhbz#2144003 --- ...t-minimum-password-length-of-8-bytes.patch | 86 +++++++++++++++++++ openssl.spec | 4 + 2 files changed, 90 insertions(+) create mode 100644 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch diff --git a/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch b/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch new file mode 100644 index 0000000..181fedd --- /dev/null +++ b/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch @@ -0,0 +1,86 @@ +From 754862899058cfb5f2341c81f9e04dd2f7b37056 Mon Sep 17 00:00:00 2001 +From: Clemens Lang +Date: Thu, 17 Nov 2022 18:37:17 +0100 +Subject: [PATCH] pbkdf2: Set minimum password length of 8 bytes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The Implementation Guidance for FIPS 140-3 says in section D.N +"Password-Based Key Derivation for Storage Applications" that "the +vendor shall document in the module’s Security Policy the length of +a password/passphrase used in key derivation and establish an upper +bound for the probability of having this parameter guessed at random. +This probability shall take into account not only the length of the +password/passphrase, but also the difficulty of guessing it. The +decision on the minimum length of a password used for key derivation is +the vendor’s, but the vendor shall at a minimum informally justify the +decision." + +We are choosing a minimum password length of 8 bytes, because NIST's +ACVP testing uses passwords as short as 8 bytes, and requiring longer +passwords combined with an implicit indicator (i.e., returning an error) +would cause the module to fail ACVP testing. + +Signed-off-by: Clemens Lang +--- + providers/implementations/kdfs/pbkdf2.c | 27 ++++++++++++++++++++++++- + 1 file changed, 26 insertions(+), 1 deletion(-) + +diff --git a/providers/implementations/kdfs/pbkdf2.c b/providers/implementations/kdfs/pbkdf2.c +index 2a0ae63acc..aa0adce5e6 100644 +--- a/providers/implementations/kdfs/pbkdf2.c ++++ b/providers/implementations/kdfs/pbkdf2.c +@@ -35,6 +35,21 @@ + #define KDF_PBKDF2_MAX_KEY_LEN_DIGEST_RATIO 0xFFFFFFFF + #define KDF_PBKDF2_MIN_ITERATIONS 1000 + #define KDF_PBKDF2_MIN_SALT_LEN (128 / 8) ++/* The Implementation Guidance for FIPS 140-3 says in section D.N ++ * "Password-Based Key Derivation for Storage Applications" that "the vendor ++ * shall document in the module’s Security Policy the length of ++ * a password/passphrase used in key derivation and establish an upper bound ++ * for the probability of having this parameter guessed at random. This ++ * probability shall take into account not only the length of the ++ * password/passphrase, but also the difficulty of guessing it. The decision on ++ * the minimum length of a password used for key derivation is the vendor’s, ++ * but the vendor shall at a minimum informally justify the decision." ++ * ++ * We are choosing a minimum password length of 8 bytes, because NIST's ACVP ++ * testing uses passwords as short as 8 bytes, and requiring longer passwords ++ * combined with an implicit indicator (i.e., returning an error) would cause ++ * the module to fail ACVP testing. */ ++#define KDF_PBKDF2_MIN_PASSWORD_LEN (8) + + static OSSL_FUNC_kdf_newctx_fn kdf_pbkdf2_new; + static OSSL_FUNC_kdf_freectx_fn kdf_pbkdf2_free; +@@ -186,9 +201,15 @@ static int kdf_pbkdf2_set_ctx_params(void *vctx, const OSSL_PARAM params[]) + ctx->lower_bound_checks = pkcs5 == 0; + } + +- if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL) ++ if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL) { ++ if (ctx->lower_bound_checks != 0 ++ && p->data_size < KDF_PBKDF2_MIN_PASSWORD_LEN) { ++ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); ++ return 0; ++ } + if (!pbkdf2_set_membuf(&ctx->pass, &ctx->pass_len, p)) + return 0; ++ } + + if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) { + if (ctx->lower_bound_checks != 0 +@@ -297,6 +318,10 @@ static int pbkdf2_derive(const char *pass, size_t passlen, + } + + if (lower_bound_checks) { ++ if (passlen < KDF_PBKDF2_MIN_PASSWORD_LEN) { ++ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); ++ return 0; ++ } + if ((keylen * 8) < KDF_PBKDF2_MIN_KEY_LEN_BITS) { + ERR_raise(ERR_LIB_PROV, PROV_R_KEY_SIZE_TOO_SMALL); + return 0; +-- +2.38.1 + diff --git a/openssl.spec b/openssl.spec index 043d28f..2ed1533 100644 --- a/openssl.spec +++ b/openssl.spec @@ -172,6 +172,8 @@ Patch81: 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch Patch82: 0082-kbkdf-Add-explicit-FIPS-indicator-for-key-length.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2136250 Patch83: 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2137557 +Patch84: 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch #https://bugzilla.redhat.com/show_bug.cgi?id=2142121 Patch85: 0085-FIPS-RSA-disable-shake.patch #https://github.com/openssl/openssl/pull/17546 @@ -523,6 +525,8 @@ install -m644 %{SOURCE9} \ Resolves: rhbz#2144019 - Add explicit indicator for HMAC with short key lengths Resolves: rhbz#2144000 +- Set minimum password length for PBKDF2 in FIPS mode + Resolves: rhbz#2144003 * Tue Nov 01 2022 Dmitry Belyavskiy - 1:3.0.1-43 - CVE-2022-3602: X.509 Email Address Buffer Overflow