oss-security - GnuPG computation error checks

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140710112641.GA25004@openwall.com>
Date: Thu, 10 Jul 2014 15:26:41 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: GnuPG computation error checks

Hi,

There was a discussion in 2001 and patches by Florian Weimer to add
extra checks into GnuPG's cipher/rsa.c: check_secret_key() and rsa_sign():

http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/017110.html
http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/017114.html
http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/017123.html

IIUC, part of the rationale was to protect against "occasional bit
flipping" compromising the secret key.

Unfortunately, the link to Florian's patch in those postings is broken,
but it's still in the GnuPG package in Owl and ALT Linux (for 1.4.18).

Here's a revision of the patch (for older GnuPG), while we still had it
as a separate patch file:

http://cvsweb.openwall.com/cgi/cvsweb.cgi/~checkout~/Owl/packages/gnupg/Attic/gnupg-1.4.2-fw-secret-key-checks.diff?rev=1.1;content-type=text%2Fplain

Here's a question:

Given the improved RSA side-channel attack understanding and the
countermeasures added to deal with CVE-2013-4242 and CVE-2013-4576
(cache timing and acoustic side-channels) in GnuPG, are Florian's added
checks still safe to have, or are they possibly vulnerable to
side-channel leaks on their own?  check_secret_key() does perform a very
basic sanity check on the secret key even without Florian's patch, and
this might be a side-channel leak concern too, but Florian's checks are
(purposefully) much more extended and include a check in rsa_sign() as
well (more susceptible since it involves dealing with changing and
possibly attacker-chosen data rather than only with the secret key?)

I haven't looked into RSA side-channel issues before, only reading about
them passively (albeit with curiosity), so I'd appreciate comments by
someone more knowledgeable in this area.

Oh, and maybe we (still) want to get the computation error checks
upstream'ed, if they can be made side-channel safe (or somehow are
side-channel safe as-is)?

Florian?

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.