1387108 - 8175110, CVE-2017-10118: Higher quality ECDSA operations

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[[e-mail]]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0
Build ID: 20170705063546

Steps to reproduce:

OpenJDK and NSS share a common source for elliptic curve cryptography code in the form of the SunEC library.

The following security fix for the OpenJDK copy of the code was released on the 18th of July, 2017:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/996632997de8

and should also be considered for NSS. It adds a timing mitigation to ec_GFp_pt_mul_jm_wNAF.

Comment 1

[Daniel Veditz [:dveditz]]

CVE-2017-10118 is still "reserved". Do you know who obtained it? is there a link to an advisory for this change?

A fix for the NSS implementation would need a separate CVE because it's a different codebase/language, despite common ancestry.

Comment 2

[Daniel Veditz [:dveditz]]

Skimming the patch I guess this is to prevent a timing attack? "higher quality" is a really vague description.

Comment 3

[Franziskus Kiefer [:franziskus]]

Yep, looks like they try to prevent some timing attacks in ec_GFp_pt_mul_jm_wNAF. Not super successful though. wNAF is leaking timing information all over the place. (I'd need to spend a little more time looking at the exact impact of the countermeasure.) The only fix that makes sense to me is not to use wNAF. Luckily the curve that's most used (P256) doesn't use this function.

Comment 4

[[e-mail]]

It was obtained by Oracle. All the CVEs they obtained for the latest OpenJDK update last month are still reserved, as far as I can see.

Oracle security update: http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA
IcedTea release based on that update: http://bitly.com/it30500

They use deliberately vague descriptions for their security patches, some verging on amusing. I'm afraid the only information we have is the public patch and the link above.

Comment 5

[Kevin Jacobs [:kjacobs]]

NSS 3.55 replaced both P384 and P521 with verifiable implementations from Fiat-Crypto and ECCKiila. I'm closing this bug as code in question is no longer used in NSS, and to the best of our knowledge no such issues are present in the new code.