1834672 - guard against excessive iteration count in PKCS#12 files

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P3)

Description

[Marc Schoenefeld]

Attachment: outfile_2147483647.p12

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36

Steps to reproduce:

• Create a PKCS12 file from a certificate, set the mac iteration count to 2147483647

• Installed firefox 113.0.2-1 from Mozilla on Ubuntu 22.04

• Imported a certificate in PKCS12 format in Certificate Manager. The supplied file outfile_2147483647.p12 has a mac iteration count set to 2147483647 (and password is empty)

openssl pkcs12 -info -in outfile_2147483647.p12
Enter Import Password:
MAC: sha256, Iteration 2147483647
MAC length: 32, salt length: 8
^C

Actual results:

Firefox GUI locks up for unexpectedly long time, and CPU usage goes up to max.
893244 user 20 0 11.1g 497080 201956 R 100.0 3.1 37:03.87 firefox

Expected results:

Firefox should have warned about service interruption due to high max iteration count (as by NIST recommendation).

Behavior of other tools:

• The Java keytool rejects the iteration count as being to high
• Schannel certutil reacts with a decoding error

Industry recommendation:
The Nist publication 800-132 "Recommendation for Password-Based Key Derivation" recommends to handle iteration counts carefully: "The iteration count shall be selected as large as possible, as long as the time required to generate the key using the entered password is acceptable for the users". Since the iteration count is known before importing the entire file, this recommendation may also apply for importing such files too.

Comment 1

[Marc Schoenefeld]

The process is busy here:

#0 0x00007f592f45b0f0 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libfreeblpriv3.so
#1 0x00007f592f45c596 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libfreeblpriv3.so
#2 0x00007f592f3e3a78 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libfreeblpriv3.so
#3 0x00007f592f4bf9eb in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsoftokn3.so
#4 0x00007f592f4cf5db in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsoftokn3.so
#5 0x00007f592f4cf2b0 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsoftokn3.so
#6 0x00007f594a9c4036 in PK11_KeyGenWithTemplate () from target:/snap/firefox/2710/usr/lib/firefox/libnss3.so
#7 0x00007f594a9c3d95 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libnss3.so
#8 0x00007f594a9c03aa in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libnss3.so
#9 0x00007f594a9c0583 in PK11_PBEKeyGen () from target:/snap/firefox/2710/usr/lib/firefox/libnss3.so
#10 0x00007f594b4154c9 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#11 0x00007f594b41bb81 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#12 0x00007f594b41ab24 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#13 0x00007f594b445f16 in SEC_ASN1DecoderUpdate_Util () from target:/snap/firefox/2710/usr/lib/firefox/libnssutil3.so
#14 0x00007f594b41ac63 in SEC_PKCS7DecoderUpdate () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#15 0x00007f594b447705 in SEC_ASN1DecoderUpdate_Util () from target:/snap/firefox/2710/usr/lib/firefox/libnssutil3.so
#16 0x00007f594b4151fb in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#17 0x00007f594b41bf46 in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#18 0x00007f594b447705 in SEC_ASN1DecoderUpdate_Util () from target:/snap/firefox/2710/usr/lib/firefox/libnssutil3.so
#19 0x00007f594b41ac63 in SEC_PKCS7DecoderUpdate () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#20 0x00007f594b41506d in ?? () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so
#21 0x00007f594b447705 in SEC_ASN1DecoderUpdate_Util () from target:/snap/firefox/2710/usr/lib/firefox/libnssutil3.so
#22 0x00007f594b413489 in SEC_PKCS12DecoderUpdate () from target:/snap/firefox/2710/usr/lib/firefox/libsmime3.so

Comment 2

[:Gijs (he/him)]

Not sure this needs to be security-sensitive as this functionality is not (AFAIK) exposed to the web. Dana?

Comment 3

[Marc Schoenefeld]

As expected, this would also affect pk12util to stall with high CPU. A secure default to be checked prior mac calculation could be helpful.

Comment 4

[Dana Keeler (she/her) [:keeler]]

This isn't exposed to web content. In any case, I think NSS should provide some way of handling this - maybe either a parameter that specifies the max iteration count, or setting a default and returning an error, etc.

Comment 5

[Marc Schoenefeld]

This also affects pk12util, it accepts any password and stalls forever.

After two years, any new movement to fix this?

Comment 7

[Maurice Dauer [:mdauer]]

Attachment: Bug 1834672 - Limit PBE iteration count, r?#nss-reviewers

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/e8fd949ee7dc
Limit PBE iteration count, r=nss-reviewers,djackson

Comment 9

[Robert Relyea]

So the iterator in the p12 file is 2^31, which is likely already the max (if we pass the iterators around as signed 32 bit integers). It's probably too excessive for today's machines (see times below), but the patch cuts the MAX to something way too small. It's 5 million and not even one order of magnitude greater than our current default iterator. Mores law will continue to put upward pressure on this value, so 5 million is way too small.

On my 3 year old machine, I get the following times:
2^31 (~2billion): 22 minutes (OK I agree that's probably too long)
1 billion: 7 minutes
100 million: 42 seconds (I think we should set it to this value).
10 million: 7 seconds

Other notes: openssl handles 1 billion just fine (taking about 10% more time than nss) and 2^31 (30 minutes)

Comment 10

[Maurice Dauer [:mdauer]]

Attachment: Bug 1834672 - Adjust PBE iteration limit, r?rrelyea,#nss-reviewers

Comment 11

[Alicja Kario]

agree with Bob, reducing the max acceptable iteration count to something like 5 times what we considered fine for default export (1 million) is way too restrictive

if the problem is that the process is hangs, then the solution is to allow the user to abort it, possibly provide them with a progress bar

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/0d2b787ce017
Adjust PBE iteration limit, r=rrelyea,nss-reviewers