From owner-svn-src-all@freebsd.org Thu Apr 23 17:56:49 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id BB6472BEE85; Thu, 23 Apr 2020 17:56:49 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 497Q3j4X2Bz47fj; Thu, 23 Apr 2020 17:56:49 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 790DF870B; Thu, 23 Apr 2020 17:56:49 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 03NHunAc050091; Thu, 23 Apr 2020 17:56:49 GMT (envelope-from cem@FreeBSD.org) Received: (from cem@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 03NHunhq050090; Thu, 23 Apr 2020 17:56:49 GMT (envelope-from cem@FreeBSD.org) Message-Id: <202004231756.03NHunhq050090@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cem set sender to cem@FreeBSD.org using -f From: Conrad Meyer Date: Thu, 23 Apr 2020 17:56:49 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r360226 - in head/sbin: decryptcore dumpon X-SVN-Group: head X-SVN-Commit-Author: cem X-SVN-Commit-Paths: in head/sbin: decryptcore dumpon X-SVN-Commit-Revision: 360226 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Apr 2020 17:56:49 -0000 Author: cem Date: Thu Apr 23 17:56:48 2020 New Revision: 360226 URL: https://svnweb.freebsd.org/changeset/base/360226 Log: EKCD: Preload error strings, PRNG seed; use OAEP padding Preload OpenSSL ERR string data so that the formatted error messages are vaguely meaningful. Add OpenSSL error information to the RSA_public_encrypt() operation failure case in one-time key generation. For obsolescent OpenSSL versions (*cough* FIPS *cough*), pre-seed the PRNG before entering Cap mode, as old versions of OpenSSL are unaware of kernel RNG interfaces aside from /dev/random (such as the long-supported kern.arnd, or the slightly more recent getentropy(3) or getrandom(2)). (RSA_public_encrypt() wants a seeded PRNG to randomize the "PS" portion of PKCS 1.5 padding or the "MGF" pseudo-random function in OAEP padding.) Switch dumpon to encrypt the one-time key with OAEP padding (recommended since 1998; RFC2437) rather than the obsolescent PKCS 1.5 padding (1993; RFC2313). Switch decryptcore to attempt OAEP decryption first, and try PKCS 1.5 decryption on failure. This is intended only for transition convenience, and we should obsolete support for non-OAEP padding in a release or two. Reviewed by: markj MFC After: 2 weeks Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D24534 Modified: head/sbin/decryptcore/decryptcore.c head/sbin/dumpon/dumpon.c Modified: head/sbin/decryptcore/decryptcore.c ============================================================================== --- head/sbin/decryptcore/decryptcore.c Thu Apr 23 17:46:29 2020 (r360225) +++ head/sbin/decryptcore/decryptcore.c Thu Apr 23 17:56:48 2020 (r360226) @@ -219,6 +219,10 @@ decrypt(int ofd, const char *privkeyfile, const char * if (RSA_private_decrypt(kdk->kdk_encryptedkeysize, kdk->kdk_encryptedkey, key, privkey, + RSA_PKCS1_OAEP_PADDING) != sizeof(key) && + /* Fallback to deprecated, formerly-used PKCS 1.5 padding. */ + RSA_private_decrypt(kdk->kdk_encryptedkeysize, + kdk->kdk_encryptedkey, key, privkey, RSA_PKCS1_PADDING) != sizeof(key)) { pjdlog_error("Unable to decrypt key: %s", ERR_error_string(ERR_get_error(), NULL)); Modified: head/sbin/dumpon/dumpon.c ============================================================================== --- head/sbin/dumpon/dumpon.c Thu Apr 23 17:46:29 2020 (r360225) +++ head/sbin/dumpon/dumpon.c Thu Apr 23 17:56:48 2020 (r360226) @@ -77,6 +77,7 @@ __FBSDID("$FreeBSD$"); #ifdef HAVE_CRYPTO #include #include +#include #include #endif @@ -224,6 +225,18 @@ genkey(const char *pubkeyfile, struct diocskerneldump_ if (fp == NULL) err(1, "Unable to open %s", pubkeyfile); + /* + * Obsolescent OpenSSL only knows about /dev/random, and needs to + * pre-seed before entering cap mode. For whatever reason, + * RSA_pub_encrypt uses the internal PRNG. + */ +#if OPENSSL_VERSION_NUMBER < 0x10100000L + { + unsigned char c[1]; + RAND_bytes(c, 1); + } +#endif + if (caph_enter() < 0) err(1, "Unable to enter capability mode"); @@ -286,8 +299,9 @@ genkey(const char *pubkeyfile, struct diocskerneldump_ arc4random_buf(kdap->kda_key, sizeof(kdap->kda_key)); if (RSA_public_encrypt(sizeof(kdap->kda_key), kdap->kda_key, kdap->kda_encryptedkey, pubkey, - RSA_PKCS1_PADDING) != (int)kdap->kda_encryptedkeysize) { - errx(1, "Unable to encrypt the one-time key."); + RSA_PKCS1_OAEP_PADDING) != (int)kdap->kda_encryptedkeysize) { + errx(1, "Unable to encrypt the one-time key: %s", + ERR_error_string(ERR_get_error(), NULL)); } RSA_free(pubkey); } @@ -470,8 +484,11 @@ main(int argc, char *argv[]) usage(); #ifdef HAVE_CRYPTO - if (cipher != KERNELDUMP_ENC_NONE && pubkeyfile == NULL) + if (cipher != KERNELDUMP_ENC_NONE && pubkeyfile == NULL) { errx(EX_USAGE, "-C option requires a public key file."); + } else if (pubkeyfile != NULL) { + ERR_load_crypto_strings(); + } #else if (pubkeyfile != NULL) errx(EX_UNAVAILABLE,"Unable to use the public key."