-
Notifications
You must be signed in to change notification settings - Fork 113
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
python-rsa does not detect ciphertext modification (prepended "0" bytes) in PKCS1_v1_5 #146
Comments
This issue seem to have CVE-2020-13757 assigned. |
Thanks for pointing this out, and for providing test code. |
…o bytes Reject cyphertexts that have been modified by prepending zero bytes, by checking the cyphertext length against the expected size (given the decryption key). This resolves CVE-2020-13757. The same approach is used when verifying a signature. Thanks Carnil for pointing this out on #146
@sybrenstuvel I think there was actually a misscredit in the commit, note that the issue was pointed out by @adelapie (I only actually stumpled over this bug while checking the CVE feeds from MITRE). That said I think the best person to peer review the changes is as well @adelapie |
I stand corrected. @adelapie would you like to give it a test for me? |
Thanks for the correction @sybrenstuvel and @carnil. Indeed it was me who found this error and filled the CVE. It works for me @sybrenstuvel :)
Thanks for your fast response, |
How soon will there be a point release with this fix in it? This CVE blocks the use of this package as found on Pypi. |
I'm preparing the release right now. |
It's been released as version 4.1. |
Awesome - eagerly awaiting this to appear on https://pypi.org/project/rsa/ Edit - actually, I see it at https://pypi.org/project/python-rsa/ ... is the other project defunct now? This is a problem, as any dependency using |
Thank you for pointing this out, I was wondering why version 4.1 didn't show up where I expected it. I switched to Poetry to publish the files to PyPi, and it decided to do that under a different project name. So no, not intentional at all. |
Thanks for sorting that out! |
…o bytes Reject cyphertexts that have been modified by prepending zero bytes, by checking the cyphertext length against the expected size (given the decryption key). This resolves CVE-2020-13757. The same approach is used when verifying a signature. Thanks Carnil for pointing this out on #146
Hello,
Using this testcase from Google Wycheproof:
I found that python-rsa (I'm using python-rsa 4.0) does not detect if bytes "0" have been prepended to the ciphertext using 2048, 3072 and 4096 bit keys and it decrypts the ciphertext without error. However, python-rsa detects if bytes "0" have been appended to the ciphertext and does not decrypt the ciphertext.
You can see this behaviour with 2048, 3072 and 4096 bit keys and the testvectors from Google Wycheproof below:
2048-bit test vector:
3072-bit test vector:
4096-bit test vector:
On the other hand, pcryptodome detects whenever bytes "0" are prepended to the ciphertext:
Best regards,
Antonio
The text was updated successfully, but these errors were encountered: