Re: Common PKCS#7 / CMS parsing issues in OpenSSL, WolfSSL, Bouncy Castle, & GnuPG

[Peter Gutmann <pgut001 () cs auckland ac nz>]

Alan Coopersmith <alan.coopersmith () oracle com> writes:

> The common failure is accepting the sender provided length for the
> authentication tag, and not enforcing the minimum length specified in the RFC
> - allowing an attacker to specify a one-byte tag length and then use brute
> force to determine which of the 256 possible values matches the first byte of
> the actual tag.

As with far too many other RFCs, the required skill for them isn't
implementing them correctly, it's knowing which bits you need to ignore in
order to implement them appropriately.  I just checked my code and it
hardcodes an allowed MAC length range of 16 ... 64 bytes for RFC 6476 use
(Authenticated-Enveloped-Data, but with an explicit MAC), so no matter what
any RFC says you can't feed it a MAC value less than 128 bits.

And an additional thought, these are all very high-visibility libraries and
therefore obvious targets for checking whether they get it right.  Given the
failure rate with those, I wonder how many other lesser-known ones also got it
wrong?

Peter.