1552208 - (CVE-2019-11727) NSS client will sign CertificateVerify message with rsa_pkcs1_sha256 SignatureScheme in TLS 1.3

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Alicja Kario]

Attachment: pacp-trace.tar.gz

It's possible to force NSS client to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest.

tested with nss-4.34.0

packet capture with SSLKEYLOGFILE attached

Comment 1

[Alicja Kario]

typo; I've tested with nss-3.43.0

Comment 2

[Daniel Veditz [:dveditz]]

Is this a "vulnerability" that needs to be hidden, or an edge-case bug for people who configure their servers wrong?

Comment 3

[J.C. Jones [:jcj] (he/they)]

This does look like a spec compliance issue, as PKCS1-v1_5 signatures should not be used for TLS 1.3 messages. It's supposed to be allowed to be advertised for 1.2 backwards compat, and of course used in x.509.

I don't think this has serious security impacts -- I suppose it's another avenue for Bleichenbacker, but if only on a single message, it's probably sec-low/sec-other? :mt, can you weigh in on that?

Adding CryptoEng staff for visibility.

Comment 4

[Martin Thomson [:mt:]]

Yes, we should filter out PKCS1-v1_5. We didn't originally because we started out with no PSS, but that isn't a good reason to keep it that way.

Comment 5

[Daiki Ueno [:ueno]]

Attachment: Bug 1552208, prohibit use of RSASSA-PKCS1-v1_5 algorithms in TLS 1.3

Comment 6

[Daiki Ueno [:ueno]]

Pushed as: https://hg.mozilla.org/projects/nss/rev/0a4e8b72a92e144663c2f35d3836f7828cfc97f2

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Is this something we should consider backporting to 3.44 so it's included in Fx68 (and by extension, our next ESR)?

Comment 8

[J.C. Jones [:jcj] (he/they)]

Probably yes. Daiki, if you agree, feel free to do the backport. Otherwise, I'll add transplanting it to my todo list for the next week or so

Comment 9

[Daiki Ueno [:ueno]]

Sure, pushed to 3.44: https://hg.mozilla.org/projects/nss/rev/17c6fc2ec3c1feaed56ef59b35bf435c7d5c4949