From 95c30fb8c7f72f28ba6460602b080b638b74f19c Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 21 Mar 2014 19:24:24 -0400 Subject: some checks for PKCS1 keys being too small for the payload to be signed --- cryptography/hazmat/backends/openssl/backend.py | 22 ++++++++++++++----- cryptography/hazmat/bindings/openssl/err.py | 1 + tests/hazmat/primitives/test_rsa.py | 29 +++++++++++++++++++++++++ 3 files changed, 47 insertions(+), 5 deletions(-) diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py index 021ce8c4..923cc478 100644 --- a/cryptography/hazmat/backends/openssl/backend.py +++ b/cryptography/hazmat/backends/openssl/backend.py @@ -897,10 +897,15 @@ class _RSASignatureContext(object): if res != 1: errors = self._backend._consume_errors() assert errors[0].lib == self._backend._lib.ERR_LIB_RSA - assert (errors[0].reason == - self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE) - raise ValueError("Salt length too long for key size. Try using " - "MAX_LENGTH instead.") + raise ValueError( + { + self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE: + "Salt length too long for key size. Try using MAX_LENGTH " + "instead.", + self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY: + "Digest too large for key size. Use a larger key." + }[errors[0].reason] + ) return self._backend._ffi.buffer(buf)[:] @@ -915,7 +920,14 @@ class _RSASignatureContext(object): ) self._hash_ctx.finalize() self._hash_ctx = None - assert res == 1 + if res == 0: + errors = self._backend._consume_errors() + assert errors[0].lib == self._backend._lib.ERR_LIB_RSA + assert (errors[0].reason == + self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY) + raise ValueError("Digest too large for key size. Use a larger " + "key.") + return self._backend._ffi.buffer(sig_buf)[:sig_len[0]] def _finalize_pss(self, evp_pkey, pkey_size, evp_md): diff --git a/cryptography/hazmat/bindings/openssl/err.py b/cryptography/hazmat/bindings/openssl/err.py index 551d8217..f51393aa 100644 --- a/cryptography/hazmat/bindings/openssl/err.py +++ b/cryptography/hazmat/bindings/openssl/err.py @@ -215,6 +215,7 @@ static const int PEM_R_UNSUPPORTED_CIPHER; static const int PEM_R_UNSUPPORTED_ENCRYPTION; static const int RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE; +static const int RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY; """ FUNCTIONS = """ diff --git a/tests/hazmat/primitives/test_rsa.py b/tests/hazmat/primitives/test_rsa.py index 236a3bb1..1cbd1636 100644 --- a/tests/hazmat/primitives/test_rsa.py +++ b/tests/hazmat/primitives/test_rsa.py @@ -655,6 +655,35 @@ class TestRSASignature(object): private_key.signer(padding.PSS(mgf=DummyMGF()), hashes.SHA1(), backend) + def test_pkcs1_digest_too_large_for_key_size(self, backend): + private_key = rsa.RSAPrivateKey.generate( + public_exponent=65537, + key_size=599, + backend=backend + ) + signer = private_key.signer( + padding.PKCS1v15(), + hashes.SHA512(), + backend + ) + signer.update(b"failure coming") + with pytest.raises(ValueError): + signer.finalize() + + def test_pkcs1_minimum_key_size(self, backend): + private_key = rsa.RSAPrivateKey.generate( + public_exponent=65537, + key_size=745, + backend=backend + ) + signer = private_key.signer( + padding.PKCS1v15(), + hashes.SHA512(), + backend + ) + signer.update(b"no failure") + signer.finalize() + @pytest.mark.rsa class TestRSAVerification(object): -- cgit v1.2.3 From 9a5b4fc5e9c6524a8d35f2b14f17016a9d979114 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 4 Apr 2014 22:22:17 -0500 Subject: remove dict, assert things still --- cryptography/hazmat/backends/openssl/backend.py | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py index 923cc478..538e6a5f 100644 --- a/cryptography/hazmat/backends/openssl/backend.py +++ b/cryptography/hazmat/backends/openssl/backend.py @@ -897,15 +897,18 @@ class _RSASignatureContext(object): if res != 1: errors = self._backend._consume_errors() assert errors[0].lib == self._backend._lib.ERR_LIB_RSA - raise ValueError( - { - self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE: - "Salt length too long for key size. Try using MAX_LENGTH " - "instead.", - self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY: - "Digest too large for key size. Use a larger key." - }[errors[0].reason] - ) + assert (errors[0].reason == + self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE or + errors[0].reason == + self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY) + if (errors[0].reason == + self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE): + reason = ("Salt length too long for key size. Try using " + "MAX_LENGTH instead.") + if (errors[0].reason == + self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY): + reason = "Digest too large for key size. Use a larger key." + raise ValueError(reason) return self._backend._ffi.buffer(buf)[:] -- cgit v1.2.3 From b16937fed8ef6afebdb1f3198d145df876497c81 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Mon, 14 Apr 2014 16:09:05 -0400 Subject: address review concerns --- cryptography/hazmat/backends/openssl/backend.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py index 538e6a5f..b3c2f0ee 100644 --- a/cryptography/hazmat/backends/openssl/backend.py +++ b/cryptography/hazmat/backends/openssl/backend.py @@ -901,13 +901,15 @@ class _RSASignatureContext(object): self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE or errors[0].reason == self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY) + reason = None if (errors[0].reason == self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE): reason = ("Salt length too long for key size. Try using " "MAX_LENGTH instead.") - if (errors[0].reason == + elif (errors[0].reason == self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY): reason = "Digest too large for key size. Use a larger key." + assert reason is not None raise ValueError(reason) return self._backend._ffi.buffer(buf)[:] -- cgit v1.2.3 From 07827ebe994121262ab0d25936c443d81be7f9c4 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Sat, 19 Apr 2014 12:38:22 -0500 Subject: remove redundant assert (reason assertion covers this case) --- cryptography/hazmat/backends/openssl/backend.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/cryptography/hazmat/backends/openssl/backend.py b/cryptography/hazmat/backends/openssl/backend.py index b3c2f0ee..9ac062c2 100644 --- a/cryptography/hazmat/backends/openssl/backend.py +++ b/cryptography/hazmat/backends/openssl/backend.py @@ -897,10 +897,6 @@ class _RSASignatureContext(object): if res != 1: errors = self._backend._consume_errors() assert errors[0].lib == self._backend._lib.ERR_LIB_RSA - assert (errors[0].reason == - self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE or - errors[0].reason == - self._backend._lib.RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY) reason = None if (errors[0].reason == self._backend._lib.RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE): -- cgit v1.2.3