diff options
| author | Eric Biggers <ebiggers@google.com> | 2022-01-18 16:13:04 -0800 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2022-01-31 11:21:44 +1100 |
| commit | 0d0aac0ddfa341f8c995f903070915f1aa868d61 (patch) | |
| tree | e6142d41ac661d5f191d7037b48ee8e52f582fe0 | |
| parent | 6a21fe5a89dd5d8fcefc53aad75cc68f1dfcb3cb (diff) | |
| download | linux-crypto-0d0aac0ddfa341f8c995f903070915f1aa868d61.tar.gz linux-crypto-0d0aac0ddfa341f8c995f903070915f1aa868d61.zip | |
crypto: rsa-pkcs1pad - restore signature length check
RSA PKCS#1 v1.5 signatures are required to be the same length as the RSA
key size. RFC8017 specifically requires the verifier to check this
(https://datatracker.ietf.org/doc/html/rfc8017#section-8.2.2).
Commit 39669c60ba49 ("crypto: Add hash param to pkcs1pad") changed the
kernel to allow longer signatures, but didn't explain this part of the
change; it seems to be unrelated to the rest of the commit.
Revert this change, since it doesn't appear to be correct.
We can be pretty sure that no one is relying on overly-long signatures
(which would have to be front-padded with zeroes) being supported, given
that they would have been broken since commit 5bb3d56f3518
("crypto: akcipher - new verify API for public key algorithms").
Fixes: 39669c60ba49 ("crypto: Add hash param to pkcs1pad")
Cc: <stable@vger.kernel.org> # v4.6+
Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
Suggested-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | crypto/rsa-pkcs1pad.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c index 7b223ade..6b556dde 100644 --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -538,7 +538,7 @@ static int pkcs1pad_verify(struct akcipher_request *req) if (WARN_ON(req->dst) || WARN_ON(!req->dst_len) || - !ctx->key_size || req->src_len < ctx->key_size) + !ctx->key_size || req->src_len != ctx->key_size) return -EINVAL; req_ctx->out_buf = kmalloc(ctx->key_size + req->dst_len, GFP_KERNEL); |