Skip to content

Commit dae8ce0

Browse files
committed
Fix #165: CVE-2020-25658 - Bleichenbacher-style timing oracle
Use as many constant-time comparisons as practical in the `rsa.pkcs1.decrypt` function. `cleartext.index(b'\x00', 2)` will still be non-constant-time. The alternative would be to iterate over all the data byte by byte in Python, which is several orders of magnitude slower. Given that a perfect constant-time implementation is very hard or even impossible to do in Python [1], I chose the more performant option here. [1]: https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/
1 parent 6f59ff0 commit dae8ce0

File tree

2 files changed

+13
-4
lines changed

2 files changed

+13
-4
lines changed

CHANGELOG.md

+5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Python-RSA changelog
22

3+
## Version 4.7 - in development
4+
5+
- Fix #165: CVE-2020-25658 - Bleichenbacher-style timing oracle in PKCS#1 v1.5
6+
decryption code
7+
38

49
## Version 4.4 & 4.6 - released 2020-06-12
510

rsa/pkcs1.py

+8-4
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import os
3131
import sys
3232
import typing
33+
from hmac import compare_digest
3334

3435
from . import common, transform, core, key
3536

@@ -251,17 +252,20 @@ def decrypt(crypto: bytes, priv_key: key.PrivateKey) -> bytes:
251252
# Detect leading zeroes in the crypto. These are not reflected in the
252253
# encrypted value (as leading zeroes do not influence the value of an
253254
# integer). This fixes CVE-2020-13757.
254-
if len(crypto) > blocksize:
255-
raise DecryptionError('Decryption failed')
255+
crypto_len_bad = len(crypto) > blocksize
256256

257257
# If we can't find the cleartext marker, decryption failed.
258-
if cleartext[0:2] != b'\x00\x02':
259-
raise DecryptionError('Decryption failed')
258+
cleartext_marker_bad = not compare_digest(cleartext[:2], b'\x00\x02')
260259

261260
# Find the 00 separator between the padding and the message
262261
try:
263262
sep_idx = cleartext.index(b'\x00', 2)
264263
except ValueError:
264+
sep_idx = -1
265+
sep_idx_bad = sep_idx < 0
266+
267+
anything_bad = crypto_len_bad | cleartext_marker_bad | sep_idx_bad
268+
if anything_bad:
265269
raise DecryptionError('Decryption failed')
266270

267271
return cleartext[sep_idx + 1:]

0 commit comments

Comments
 (0)