1588941 - trying to use a client certificate from a PKCS#11 token that doesn't implement RSA-PSS with TLS 1.3 results in an assertion failure

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

STR: get a PKCS#11 module/token that doesn't support RSA-PSS but does have an RSA client certificate and try to use it with a server that negotiates TLS 1.3 (e.g. osclientcerts: https://github.com/mozkeeler/osclientcerts). This results in an assertion failure as a result of ssl_PickClientSignatureScheme not being able to find an acceptable signature scheme in ssl3_CompleteHandleCertificateRequest.

Comment 1

[J.C. Jones [:jcj] (he/him)]

I agree, it seems like it shouldn't be a fatal error on the connection for the PKCS11 module to not support the scheme - the logic might want to just avoid client auth. CC-ing :mt.

Comment 2

[Martin Thomson [:mt:]]

For client certificates in particular, there is new work that proposes allowing this sort of signature for client certificates: https://datatracker.ietf.org/doc/draft-davidben-tls13-pkcs1/

However, this shouldn't assert. I think that this code is built with the (bad) assumption that a certificate is validated prior to reaching that point. We should fix the assertion.

Comment 3

[J.C. Jones [:jcj] (he/him)]

I will plan to tackle this next week.

Comment 4

[Michael Osipov]

(In reply to J.C. Jones [:jcj] (he/him) from comment #3)

I will plan to tackle this next week.

Were you able to make any progress? I hit this with my smartcard at work.

Comment 6

[dodo_birds]

I'm running into this bug. Is there an estimation for when a fix will be available?

Are there any known workarounds?

I am also willing to try to help create a patch. I would need help understanding the issue better at a lower level.

Comment 7

[J.C. Jones [:jcj] (he/him)]

Moving this back to untriaged so we re-tackle it next week.

Comment 8

[dodo_birds]

Any updates on this bug?

Comment 9

[J.C. Jones [:jcj] (he/him)]

It appears that this could be fixed either by:

1. Adding a sort of fall-back mechanism in NSS to retry, or
2. Being more careful in the PKCS11 drivers.

We're pursuing fixes along a the second line for osclientcerst in https://bugzilla.mozilla.org/show_bug.cgi?id=1654999#c5

Comment 10

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1588941 - Send empty client cert msg when signature scheme selection fails.

ssl3_CompleteHandleCertificateRequest does essentially two things: 1) Calls the getClientAuthData hook for certificate selection, and 2) calls ssl_PickClientSignatureScheme to select an appropriate signature scheme when a cert is selected.

If the first function returns SECFailure, we default to sending an empty certificate message. If the latter fails, however, this bubbles up as a [[ https://searchfox.org/mozilla-central/rev/56bb74ea8e04bdac57c33cbe9b54d889b9262ade/security/nss/lib/ssl/tls13con.c#2670 | fatal error ]] (and an assertion failure) on the connection. Importantly, the signature scheme selection can fail for reasons that should not be considered fatal - notably when an RSA-PSS cert is selected, but the token on which the key resides does not actually support PSS.

This patch treats the failure to find a usable signature scheme as a "no certificate" response, rather than killing the connection entirely.

Comment 11

[Kevin Jacobs [:kjacobs]]

https://hg.mozilla.org/projects/nss/rev/41ecb7fe55461da66328758a08776f2291ea4d0b