From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BBE7C433EF for ; Mon, 7 Feb 2022 13:00:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352081AbiBGNAj (ORCPT ); Mon, 7 Feb 2022 08:00:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54696 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1388333AbiBGLnd (ORCPT ); Mon, 7 Feb 2022 06:43:33 -0500 Received: from out30-44.freemail.mail.aliyun.com (out30-44.freemail.mail.aliyun.com [115.124.30.44]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1427C043181; Mon, 7 Feb 2022 03:43:31 -0800 (PST) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R151e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01e04400;MF=tianjia.zhang@linux.alibaba.com;NM=1;PH=DS;RN=13;SR=0;TI=SMTPD_---0V3r3syy_1644234208; Received: from localhost(mailfrom:tianjia.zhang@linux.alibaba.com fp:SMTPD_---0V3r3syy_1644234208) by smtp.aliyun-inc.com(127.0.0.1); Mon, 07 Feb 2022 19:43:28 +0800 From: Tianjia Zhang To: Eric Biggers , Mimi Zohar , Vitaly Chikunov , Stefan Berger , Jarkko Sakkinen , "Gilad Ben-Yossef" , David Howells , Herbert Xu , "David S. Miller" , keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, linux-integrity@vger.kernel.org Cc: Tianjia Zhang Subject: [PATCH] KEYS: asymmetric: enforce SM2 signature use pkey algo Date: Mon, 7 Feb 2022 19:43:27 +0800 Message-Id: <20220207114327.7929-1-tianjia.zhang@linux.alibaba.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220201003414.55380-1-ebiggers@kernel.org> References: <20220201003414.55380-1-ebiggers@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The signature verification of SM2 needs to add the Za value and recalculate sig->digest, which requires the detection of the pkey_algo in public_key_verify_signature(). As Eric Biggers said, the pkey_algo field in sig is attacker-controlled and should be use pkey->pkey_algo instead of sig->pkey_algo, and secondly, if sig->pkey_algo is NULL, it will also cause signature verification failure. The software_key_determine_akcipher() already forces the algorithms are matched, so the SM3 algorithm is enforced in the SM2 signature, although this has been checked, we still avoid using any algorithm information in the signature as input. Reported-by: Eric Biggers Signed-off-by: Tianjia Zhang --- crypto/asymmetric_keys/public_key.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c index a603ee8afdb8..ea9a5501f87e 100644 --- a/crypto/asymmetric_keys/public_key.c +++ b/crypto/asymmetric_keys/public_key.c @@ -309,7 +309,8 @@ static int cert_sig_digest_update(const struct public_key_signature *sig, if (ret) return ret; - tfm = crypto_alloc_shash(sig->hash_algo, 0, 0); + /* SM2 signatures always use the SM3 hash algorithm */ + tfm = crypto_alloc_shash("sm3", 0, 0); if (IS_ERR(tfm)) return PTR_ERR(tfm); @@ -414,8 +415,7 @@ int public_key_verify_signature(const struct public_key *pkey, if (ret) goto error_free_key; - if (sig->pkey_algo && strcmp(sig->pkey_algo, "sm2") == 0 && - sig->data_size) { + if (strcmp(pkey->pkey_algo, "sm2") == 0 && sig->data_size) { ret = cert_sig_digest_update(sig, tfm); if (ret) goto error_free_key; -- 2.34.1