Allow signature verification using specific RSA keys <2k in FIPS mode
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Jakuje
	May 12 2022, 2:53 PM

Description

The FIPS specified a "legacy mode", which is up to the application to decide. In this mode, usage of RSA keys of size 1024b, 1280b, 1536b, and 1792b should be allowed only for verification.

In addition, I would like to re-raise the issue if it would make sense to limit RSA key size generation and usage generally (previously mentioned in https://dev.gnupg.org/T5512#151635). Right now, there are no lower bounds for RSA key usage and tests happily use many 512b RSA keys. My suggestion would be to allow only 1024 bits and larger by default. The change is also attached in the following merge request as well as in attachment here.

https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/3

libgcrypt-rsa-verify.patch5 KBDownload

Details

Version: master

Revisions and Commits

rC libgcrypt
	rCca2afc9fb64d cipher: Allow verification of small RSA signatures in FIPS mode

Related Objects

Mentioned In: T7165: Release Libgcrypt 1.11.0
T5905: Release Libgcrypt 1.10.2
Mentioned Here: T5512: Implement service indicators

Event Timeline

Jakuje created this task.May 12 2022, 2:53 PM

I can imagine thar there are use cases for this. Thus I see no problems for the first part.

The second part is imho not a good idea. Libgcrypt is a building block for all kind of software and there are for sure legitimate reasons to use rsa512 (MCUs, short living keys, etc). Thus I think that the decision on the key size should be done by the software using libgcrypt.

Ok. Thank you for the clarification. I will drop the second part and keep only the FIPS change in the patch. Merge request already updated.

libgcrypt-rsa-verify.patch1 KBDownload

• werner moved this task from Backlog to Next on the FIPS board.May 17 2022, 11:12 AM

• gniibe added a commit: rCca2afc9fb64d: cipher: Allow verification of small RSA signatures in FIPS mode.May 19 2022, 3:48 AM

Pushed the change (master and 1.10).

In T5975#158113, @werner wrote:

I can imagine thar there are use cases for this. Thus I see no problems for the first part.

The second part is imho not a good idea. Libgcrypt is a building block for all kind of software and there are for sure legitimate reasons to use rsa512 (MCUs, short living keys, etc). Thus I think that the decision on the key size should be done by the software using libgcrypt.

RSA512 is already broken; there have been public demonstrations of this. MCUs should be using ECC instead.

• gniibe moved this task from Next to Ready for release on the FIPS board.May 31 2022, 11:16 AM

• gniibe added a project: backport.Jul 12 2022, 10:21 AM

• werner changed the task status from Open to Testing.Sep 22 2022, 10:56 AM

• werner removed a project: Restricted Project.

Fixed in 1.10.2.

• werner mentioned this in T5905: Release Libgcrypt 1.10.2.Nov 14 2023, 12:55 PM

• werner mentioned this in T7165: Release Libgcrypt 1.11.0.Jun 19 2024, 11:37 AM