Date: Thu, 10 Jul 2014 15:26:41 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: GnuPG computation error checks Hi, There was a discussion in 2001 and patches by Florian Weimer to add extra checks into GnuPG's cipher/rsa.c: check_secret_key() and rsa_sign(): http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/017110.html http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/017114.html http://lists.gnupg.org/pipermail/gnupg-devel/2001-March/017123.html IIUC, part of the rationale was to protect against "occasional bit flipping" compromising the secret key. Unfortunately, the link to Florian's patch in those postings is broken, but it's still in the GnuPG package in Owl and ALT Linux (for 1.4.18). Here's a revision of the patch (for older GnuPG), while we still had it as a separate patch file: http://cvsweb.openwall.com/cgi/cvsweb.cgi/~checkout~/Owl/packages/gnupg/Attic/gnupg-1.4.2-fw-secret-key-checks.diff?rev=1.1;content-type=text%2Fplain Here's a question: Given the improved RSA side-channel attack understanding and the countermeasures added to deal with CVE-2013-4242 and CVE-2013-4576 (cache timing and acoustic side-channels) in GnuPG, are Florian's added checks still safe to have, or are they possibly vulnerable to side-channel leaks on their own? check_secret_key() does perform a very basic sanity check on the secret key even without Florian's patch, and this might be a side-channel leak concern too, but Florian's checks are (purposefully) much more extended and include a check in rsa_sign() as well (more susceptible since it involves dealing with changing and possibly attacker-chosen data rather than only with the secret key?) I haven't looked into RSA side-channel issues before, only reading about them passively (albeit with curiosity), so I'd appreciate comments by someone more knowledgeable in this area. Oh, and maybe we (still) want to get the computation error checks upstream'ed, if they can be made side-channel safe (or somehow are side-channel safe as-is)? Florian? Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ