Blob Blame History Raw
From 9f5a60c1fe576f82bcd5c7998b2ca2b0d60e8e4f Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Thu, 27 Jan 2022 18:17:43 +0100
Subject: [PATCH 1/2] rsa_generate_fips186_4_keypair: accept a few more modulus
 sizes

While _rsa_generate_fips186_4_keypair was modified to accept modulus
sizes other than 2048 and 3076, rsa_generate_fips186_4_keypair, which
calls that function, was not updated to accept such modulus sizes.

Spotted by Alexander Sosedkin.

Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
 lib/nettle/int/rsa-keygen-fips186.c | 67 ++++++++++++++++-------------
 1 file changed, 36 insertions(+), 31 deletions(-)

diff --git a/lib/nettle/int/rsa-keygen-fips186.c b/lib/nettle/int/rsa-keygen-fips186.c
index 5b221a030a..c6f7e675af 100644
--- a/lib/nettle/int/rsa-keygen-fips186.c
+++ b/lib/nettle/int/rsa-keygen-fips186.c
@@ -27,6 +27,7 @@
 #include "config.h"
 #endif
 
+#include <assert.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -248,6 +249,33 @@ cleanup:
 	return ret;
 }
 
+/* Return the pre-defined seed length for modulus size, or 0 when the
+ * modulus size is unsupported.
+ */
+static inline unsigned
+seed_length_for_modulus_size(unsigned modulus_size)
+{
+	switch (modulus_size) {
+	case 2048:      /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */
+		return 14 * 2;
+	case 3072:      /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */
+		return 16 * 2;
+	case 4096:      /* SP 800-56B rev 2 Appendix D */
+		return 19 * 2;
+	case 6144:      /* SP 800-56B rev 2 Appendix D */
+		return 22 * 2;
+	case 7680:      /* FIPS 140-2 IG 7.5 */
+		return 24 * 2;
+	case 8192:      /* SP 800-56B rev 2 Appendix D */
+		return 25 * 2;
+	case 15360:     /* FIPS 140-2 IG 7.5 */
+		return 32 * 2;
+	default:
+		return 0;
+	}
+
+}
+
 /* This generates p,q params using the B.3.2.2 algorithm in FIPS 186-4.
  * 
  * The hash function used is SHA384.
@@ -266,33 +294,15 @@ _rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
 	int ret;
 	struct dss_params_validation_seeds cert;
 	unsigned l = n_size / 2;
+	unsigned s = seed_length_for_modulus_size(n_size);
 
-	switch (n_size) {
-	case 2048:      /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */
-		FIPS_RULE(seed_length != 14 * 2, 0, "seed length other than 28 bytes\n");
-		break;
-	case 3072:      /* SP 800-56B rev 2 Appendix D and FIPS 140-2 IG 7.5 */
-		FIPS_RULE(seed_length != 16 * 2, 0, "seed length other than 32 bytes\n");
-		break;
-	case 4096:      /* SP 800-56B rev 2 Appendix D */
-		FIPS_RULE(seed_length != 19 * 2, 0, "seed length other than 38 bytes\n");
-		break;
-	case 6144:      /* SP 800-56B rev 2 Appendix D */
-		FIPS_RULE(seed_length != 22 * 2, 0, "seed length other than 44 bytes\n");
-		break;
-	case 7680:      /* FIPS 140-2 IG 7.5 */
-		FIPS_RULE(seed_length != 24 * 2, 0, "seed length other than 48 bytes\n");
-		break;
-	case 8192:      /* SP 800-56B rev 2 Appendix D */
-		FIPS_RULE(seed_length != 25 * 2, 0, "seed length other than 50 bytes\n");
-		break;
-	case 15360:     /* FIPS 140-2 IG 7.5 */
-		FIPS_RULE(seed_length != 32 * 2, 0, "seed length other than 64 bytes\n");
-		break;
-	default:
+	if (!s) {
 		FIPS_RULE(false, 0, "unsupported modulus size\n");
 	}
 
+	FIPS_RULE(seed_length != s, 0,
+		  "seed length other than %u bytes\n", s);
+
 	if (!mpz_tstbit(pub->e, 0)) {
 		_gnutls_debug_log("Unacceptable e (it is even)\n");
 		return 0;
@@ -405,10 +415,6 @@ _rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
 	return ret;
 }
 
-/* Not entirely accurate but a good precision
- */
-#define SEED_LENGTH(bits) (_gnutls_pk_bits_to_subgroup_bits(bits)/8)
-
 /* This generates p,q params using the B.3.2.2 algorithm in FIPS 186-4.
  * 
  * The hash function used is SHA384.
@@ -429,11 +435,10 @@ rsa_generate_fips186_4_keypair(struct rsa_public_key *pub,
 	unsigned seed_length;
 	int ret;
 
-	FIPS_RULE(n_size != 2048 && n_size != 3072, 0, "size of prime of other than 2048 or 3072\n");
+	seed_length = seed_length_for_modulus_size(n_size);
+	FIPS_RULE(!seed_length, 0, "unsupported modulus size\n");
 
-	seed_length = SEED_LENGTH(n_size);
-	if (seed_length > sizeof(seed))
-		return 0;
+	assert(seed_length <= sizeof(seed));
 
 	random(random_ctx, seed_length, seed);
 
-- 
2.34.1


From 46ae6160489151034bca19aa6c40ba0df6b53bcc Mon Sep 17 00:00:00 2001
From: Daiki Ueno <ueno@gnu.org>
Date: Tue, 1 Feb 2022 15:19:52 +0100
Subject: [PATCH 2/2] certtool --generate-privkey: update warnings on RSA key
 sizes

Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
 src/certtool.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/certtool.c b/src/certtool.c
index c128500614..71d4aff13e 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -206,8 +206,12 @@ generate_private_key_int(common_info_st * cinfo)
 			"Note that DSA keys with size over 1024 may cause incompatibility problems when used with earlier than TLS 1.2 versions.\n\n");
 
 	if ((HAVE_OPT(SEED) || provable) && GNUTLS_PK_IS_RSA(key_type)) {
-		if (bits != 2048 && bits != 3072) {
-			fprintf(stderr, "Note that the FIPS 186-4 key generation restricts keys to 2048 and 3072 bits\n");
+		/* Keep in sync with seed_length_for_modulus_size in
+		 * lib/nettle/int/rsa-keygen-fips186.c. */
+		if (bits != 2048 && bits != 3072 && bits != 4096 &&
+		    bits != 6144 && bits != 7680 && bits != 8192 &&
+		    bits != 15360) {
+			fprintf(stderr, "Note that the FIPS 186-4 key generation restricts keys to be of known lengths (2048, 3072, etc)\n");
 		}
 	}
 
@@ -225,7 +229,15 @@ generate_private_key_int(common_info_st * cinfo)
 		kdata[kdata_size++].size = cinfo->seed_size;
 
 		if (GNUTLS_PK_IS_RSA(key_type)) {
-			if ((bits == 3072 && cinfo->seed_size != 32) || (bits == 2048 && cinfo->seed_size != 28)) {
+			/* Keep in sync with seed_length_for_modulus_size in
+			 * lib/nettle/int/rsa-keygen-fips186.c. */
+			if ((bits == 2048 && cinfo->seed_size != 28) ||
+			    (bits == 3072 && cinfo->seed_size != 32) ||
+			    (bits == 4096 && cinfo->seed_size != 38) ||
+			    (bits == 6144 && cinfo->seed_size != 44) ||
+			    (bits == 7680 && cinfo->seed_size != 48) ||
+			    (bits == 8192 && cinfo->seed_size != 50) ||
+			    (bits == 15360 && cinfo->seed_size != 64)) {
 				fprintf(stderr, "The seed size (%d) doesn't match the size of the request security level; use -d 2 for more information.\n", (int)cinfo->seed_size);
 			}
 		} else if (key_type == GNUTLS_PK_DSA) {
-- 
2.34.1