1190448 - Insufficient validation of input data

Status: RESOLVED DUPLICATE of bug 380351

(NSS :: Libraries, defect)

Description

[Watson Ladd]

Attachment: Patch that fixes the issue

In pkcs11c.c we see the following code:

	if (mechanism == CKM_ECDH1_COFACTOR_DERIVE) {
	    withCofactor = PR_TRUE;
	} else {
	    /* When not using cofactor derivation, one should
	     * validate the public key to avoid small subgroup
	     * attacks.
	     */
	    if (EC_ValidatePublicKey(&privKey->u.ec.ecParams, &ecPoint) 
		!= SECSuccess) {
		goto ec_loser;
	    }
	}

This code doesn't validate that the point is on the curve when cofactor derivation is used. But cofactor derivation doesn't prevent small subgroup attacks. For example, an attacker could send a point with order about 2^26 on some other curve, and recover the secret key modulo that order. This issue doesn't affect TLS users.

Comment 1

[Daniel Veditz [:dveditz] back 2026-04-08]

If this doesn't affect TLS are there other Firefox features that would use this code?

Comment 2

[Watson Ladd]

I don't know. You'd have to ask someone more familiar with the high level interactions, or alternatively put a canary in the code, and run a bunch of tests.

Comment 3

[Robert Relyea]

bug 38035 would make this check irrelevant because it moves the check into the EC_DH function in freebl, which would always trigger (even in the cofactor case).

I think the code in question is used by Thunderbird, not Firefox.

Comment 4

[Watson Ladd]

The link in that comment is broken, so I am not sure what bug is being referenced. I do not believe that NSS is currently performing the check in freebl after examining the source, and I think the language in your comment is consistent with that. ("would make" implying it hasn't been fixed now.) As you describe it, it sounds like it would address the issue.

Comment 5

[Daniel Veditz [:dveditz] back 2026-04-08]

Looks like he meant bug 380351

Comment 6

[Franziskus Kiefer [:franziskus]]

Closing this ad duplicate of bug 380351 that fixes this issue as well.