1531735 - Treat signed S/MIME messages that use a MD5 digest as insecure

Status: RESOLVED FIXED

(MailNews Core :: Security: S/MIME, enhancement)

Description

[Kai Engert (:KaiE:)]

Let's see if we can disable support for MD5 with S/MIME.

Comment 1

[Kai Engert (:KaiE:)]

The most recent RFC for S/MIME suggests that MD5 should be supported for backwards compatibility.
https://tools.ietf.org/html/rfc5751

However, the RFC is already 9 years old, and MD5 is considered weak.

The NSS CMS test script nss/tests/smime/smime.sh has apparently never tested the use of MD5 according to the revision history of the script, since 2000.

Comment 2

[Kai Engert (:KaiE:)]

Attachment: 1531735-v1.patch

Comment 3

[Jorg K (CEST = GMT+2)]

Ready for review?

Comment 5

[Magnus Melin [:mkmelin]]

We should probably move ahead here?

Comment 6

[Kai Engert (:KaiE:)]

Yes, it's time to fix the bug.

However, the patch isn't good. I've just tested, and it results in the message contents not being shown.
We need a patch that will cause the signature to be shown as bad/broken, but still show the message contents.

Comment 7

[Kai Engert (:KaiE:)]

Actually, we can simply treat the message as not being signed at all.

Comment 8

[Kai Engert (:KaiE:)]

Adding dependency on bug 1630688, because in that bug I'm adding code for ignoring an S/MIME signature.

Comment 9

[Kai Engert (:KaiE:)]

Attachment: Bug 1531735 - Reject S/MIME signatures that use the MD5 hash algorithm. r=mkmelin

Comment 10

[Kai Engert (:KaiE:)]

We need to postpone landing until I can fix the test regression in the dependent bug.

Comment 11

[Kai Engert (:KaiE:)]

I've had to change the dependency patch to report status as broken. Not ignoring, but reporting as bad, seems fine (or better) for this scenario, too. I'll update the revision (renamed variable).

Comment 12

[Kai Engert (:KaiE:)]

I don't have test messages for MD5 currently.
However, I do have test messages for SHA-1 (bug 1532292).

I think we should handle SHA-1 in a separate step, but while I'm working on this one, it's easy to create the patch for bug 1532292 already, and with that I can test whether this approach is generally working.

I found that this patch still has the effect of hiding the signature.
But showing a broken signature might be better.

Comment 13

[Kai Engert (:KaiE:)]

The patch is insufficient, because it only handles multipart/signed, it doesn't handle the opaque signing content type.

Comment 14

[Kai Engert (:KaiE:)]

Patch updated to fix opaque signing, too.
However, now this works depends on getting a new NSS release uplifted, which needs to export an additonal API.

Comment 15

[Kai Engert (:KaiE:)]

Landing this fix must wait until Thunderbird 112, because the NSS version 3.88 that targets FF/TB 111 is already in API freeze.

Needinfo for myself, request landing this after mozilla-central has received an NSS 3.89 Beta snapshot.

Comment 16

[Kai Engert (:KaiE:)]

Ready for landing.

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/9b819c74e061
Reject S/MIME signatures that use the MD5 hash algorithm. r=mkmelin