Utilities from the general purpose cryptography library with TLS implementation
80de7ffd9c
FIPS 186-4 section 5 "The RSA Digital Signature Algorithm", subsection 5.5 "PKCS #1" says: "For RSASSA-PSS […] the length (in bytes) of the salt (sLen) shall satisfy 0 ≤ sLen ≤ hLen, where hLen is the length of the hash function output block (in bytes)." It is not exactly clear from this text whether hLen refers to the message digest or the hash function used for the mask generation function MGF1. PKCS#1 v2.1 suggests it is the former: | Typical salt lengths in octets are hLen (the length of the output of | the hash function Hash) and 0. In both cases the security of | RSASSA-PSS can be closely related to the hardness of inverting RSAVP1. | Bellare and Rogaway [4] give a tight lower bound for the security of | the original RSA-PSS scheme, which corresponds roughly to the former | case, while Coron [12] gives a lower bound for the related Full Domain | Hashing scheme, which corresponds roughly to the latter case. In [13] | Coron provides a general treatment with various salt lengths ranging | from 0 to hLen; see [27] for discussion. See also [31], which adapts | the security proofs in [4][13] to address the differences between the | original and the present version of RSA-PSS as listed in Note 1 above. Since OpenSSL defaults to creating signatures with the maximum salt length, blocking the use of longer salts would probably lead to significant problems in practice. Instead, introduce an explicit indicator that can be obtained from the EVP_PKEY_CTX object using EVP_PKEY_CTX_get_params() with the OSSL_SIGNATURE_PARAM_REDHAT_FIPS_INDICATOR parameter. Change the default automatic behavior when signing to use at most the digest size as salt length. Signed-off-by: Clemens Lang <cllang@redhat.com> Resolves: rhbz#2144012 |
||
|---|---|---|
| .gitignore | ||
| 0001-Aarch64-and-ppc64le-use-lib64.patch | ||
| 0002-Use-more-general-default-values-in-openssl.cnf.patch | ||
| 0003-Do-not-install-html-docs.patch | ||
| 0004-Override-default-paths-for-the-CA-directory-tree.patch | ||
| 0005-apps-ca-fix-md-option-help-text.patch | ||
| 0006-Disable-signature-verification-with-totally-unsafe-h.patch | ||
| 0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch | ||
| 0008-Add-FIPS_mode-compatibility-macro.patch | ||
| 0009-Add-Kernel-FIPS-mode-flag-support.patch | ||
| 0011-Remove-EC-curves.patch | ||
| 0012-Disable-explicit-ec.patch | ||
| 0013-FIPS-provider-explicit-ec.patch | ||
| 0014-FIPS-disable-explicit-ec.patch | ||
| 0015-FIPS-decoded-from-explicit.patch | ||
| 0024-load-legacy-prov.patch | ||
| 0025-for-tests.patch | ||
| 0031-tmp-Fix-test-names.patch | ||
| 0032-Force-fips.patch | ||
| 0033-FIPS-embed-hmac.patch | ||
| 0034.fipsinstall_disable.patch | ||
| 0035-speed-skip-unavailable-dgst.patch | ||
| 0044-FIPS-140-3-keychecks.patch | ||
| 0045-FIPS-services-minimize.patch | ||
| 0046-FIPS-s390x-hardening.patch | ||
| 0047-FIPS-early-KATS.patch | ||
| 0048-correctly-handle-records.patch | ||
| 0049-Selectively-disallow-SHA1-signatures.patch | ||
| 0050-FIPS-enable-pkcs12-mac.patch | ||
| 0051-Support-different-R_BITS-lengths-for-KBKDF.patch | ||
| 0052-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch | ||
| 0053-CVE-2022-0778.patch | ||
| 0054-Replace-size-check-with-more-meaningful-pubkey-check.patch | ||
| 0055-nonlegacy-fetch-null-deref.patch | ||
| 0056-strcasecmp.patch | ||
| 0057-strcasecmp-fix.patch | ||
| 0058-FIPS-limit-rsa-encrypt.patch | ||
| 0060-FIPS-KAT-signature-tests.patch | ||
| 0061-Deny-SHA-1-signature-verification-in-FIPS-provider.patch | ||
| 0062-fips-Expose-a-FIPS-indicator.patch | ||
| 0063-CVE-2022-1473.patch | ||
| 0064-CVE-2022-1343.diff | ||
| 0065-CVE-2022-1292.patch | ||
| 0066-replace-expired-certs.patch | ||
| 0067-fix-ppc64-montgomery.patch | ||
| 0068-CVE-2022-2068.patch | ||
| 0069-CVE-2022-2097.patch | ||
| 0070-EVP_PKEY_Q_keygen-Call-OPENSSL_init_crypto-to-init-s.patch | ||
| 0071-AES-GCM-performance-optimization.patch | ||
| 0072-ChaCha20-performance-optimizations-for-ppc64le.patch | ||
| 0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch | ||
| 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch | ||
| 0075-FIPS-Use-FFDHE2048-in-self-test.patch | ||
| 0076-FIPS-140-3-DRBG.patch | ||
| 0077-FIPS-140-3-zeroization.patch | ||
| 0078-Add-FIPS-indicator-parameter-to-HKDF.patch | ||
| 0079-CVE-2022-3602.patch | ||
| 0080-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch | ||
| 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch | ||
| 0082-kbkdf-Add-explicit-FIPS-indicator-for-key-length.patch | ||
| 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch | ||
| 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch | ||
| 0085-FIPS-RSA-disable-shake.patch | ||
| 0086-avoid-bio-memleak.patch | ||
| 0087-FIPS-RSA-selftest-params.patch | ||
| 0088-signature-Add-indicator-for-PSS-salt-length.patch | ||
| 0089-signature-Clamp-PSS-salt-len-to-MD-len.patch | ||
| configuration-prefix.h | ||
| configuration-switch.h | ||
| ec_curve.c | ||
| ectest.c | ||
| gating.yaml | ||
| genpatches | ||
| hobble-openssl | ||
| make-dummy-cert | ||
| Makefile.certificate | ||
| openssl.spec | ||
| renew-dummy-cert | ||
| rpminspect.yaml | ||
| sources | ||