path: root/sbin/decryptcore
diff options
authorConrad Meyer <cem@FreeBSD.org>2020-04-23 17:56:48 +0000
committerConrad Meyer <cem@FreeBSD.org>2020-04-23 17:56:48 +0000
commit4647ce4fb6ed8e2ac65f663b8513b4a32908810a (patch)
treeda8b54ef6b85f7977dd64bc54d44b34bc954d17a /sbin/decryptcore
parent401ae7ca67d6d7c99645a1f18bf9ebd3d87930b7 (diff)
EKCD: Preload error strings, PRNG seed; use OAEP padding
Preload OpenSSL ERR string data so that the formatted error messages are vaguely meaningful. Add OpenSSL error information to the RSA_public_encrypt() operation failure case in one-time key generation. For obsolescent OpenSSL versions (*cough* FIPS *cough*), pre-seed the PRNG before entering Cap mode, as old versions of OpenSSL are unaware of kernel RNG interfaces aside from /dev/random (such as the long-supported kern.arnd, or the slightly more recent getentropy(3) or getrandom(2)). (RSA_public_encrypt() wants a seeded PRNG to randomize the "PS" portion of PKCS 1.5 padding or the "MGF" pseudo-random function in OAEP padding.) Switch dumpon to encrypt the one-time key with OAEP padding (recommended since 1998; RFC2437) rather than the obsolescent PKCS 1.5 padding (1993; RFC2313). Switch decryptcore to attempt OAEP decryption first, and try PKCS 1.5 decryption on failure. This is intended only for transition convenience, and we should obsolete support for non-OAEP padding in a release or two. Reviewed by: markj MFC After: 2 weeks Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D24534
Notes: svn path=/head/; revision=360226
Diffstat (limited to 'sbin/decryptcore')
1 files changed, 4 insertions, 0 deletions
diff --git a/sbin/decryptcore/decryptcore.c b/sbin/decryptcore/decryptcore.c
index 7fbe237487c5..80050c9a0bfb 100644
--- a/sbin/decryptcore/decryptcore.c
+++ b/sbin/decryptcore/decryptcore.c
@@ -219,6 +219,10 @@ decrypt(int ofd, const char *privkeyfile, const char *keyfile,
if (RSA_private_decrypt(kdk->kdk_encryptedkeysize,
kdk->kdk_encryptedkey, key, privkey,
+ RSA_PKCS1_OAEP_PADDING) != sizeof(key) &&
+ /* Fallback to deprecated, formerly-used PKCS 1.5 padding. */
+ RSA_private_decrypt(kdk->kdk_encryptedkeysize,
+ kdk->kdk_encryptedkey, key, privkey,
RSA_PKCS1_PADDING) != sizeof(key)) {
pjdlog_error("Unable to decrypt key: %s",
ERR_error_string(ERR_get_error(), NULL));