Sha1 runtime insecure #660

pemensik · 2022-04-08T14:38:56Z

Attempt to solve issue #656

Fallback from bogus to insecure, if crypto library returned specific error during verification.

RHEL9/CentOS 9 would fail in default crypto policy. If call to openssl returns invalid digest then report the name insecure. If all tested signatures return the same issue, then make the reply insecure.

Create a path where it can result in insecure.

Make output still only shown in verbose detail. But provide openssl error details to make a reason more obvious.

pemensik · 2022-05-17T09:39:15Z

Any comments for this change?

gthess · 2022-05-20T11:47:11Z

As I understand this is also related to FIPS. Why not just do something similar as #671 with detecting FIPS mode for the digest? Then we won't have to rely on the openssl error code for detection (which I cannot find proper documentation for its actual meaning and the stability of its use).

pemensik · 2022-05-23T10:06:00Z

The reason for it is simple. It does happen on CentOS 9 Stream and RHEL 9 in default installation. Unlike PR #671 this does not fail only when FIPS mode is enabled. It fails also when DEFAULT crypto-policy is set. Which is preselected policy on mentioned distributions.

Of course it would fail in FIPS mode too. But it is more general, because it has to be. There's a note about that in Considerations in adopting RHEL 9. And related release note mention that unbound package build currently disables all SHA-1 validation in all cases. This change would allow secure resolution of SHA-1 base name in legacy policies, but at least insecure resolution in default policy or FIPS mode.

There is pull request to enable simple check to openssl, but until that is present in openssl, it is not that simple.

Also it is good to note, it would affect both our official packages and also unofficial builds, as long as they link to openssl.

pemensik · 2022-05-24T19:29:32Z

How to check this with simple steps:

# podman run -ti quay.io/centos/centos:stream9
# dnf install -y unbound
# unbound-host -rvD ietf.org
ietf.org has address 50.223.129.194 (insecure)
ietf.org has IPv6 address 2001:559:c4c7::100 (insecure)
ietf.org mail is handled by 0 mail.ietf.org. (insecure)
# dnf install -y bind-utils
# delv ietf.org
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; validating ietf.org/DNSKEY: no valid signature found
;; insecurity proof failed resolving 'ietf.org/DNSKEY/IN': 8.8.4.4#53
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; validating ietf.org/DNSKEY: no valid signature found
;; no valid RRSIG resolving 'ietf.org/DNSKEY/IN': 8.8.8.8#53
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; EVP_VerifyFinal failed (verify failure)
;; error:03000098:digital envelope routines::invalid digest:crypto/evp/pmeth_lib.c:959:
;; validating ietf.org/DNSKEY: no valid signature found
;; no valid RRSIG resolving 'ietf.org/DNSKEY/IN': 10.0.2.3#53
;; broken trust chain resolving 'ietf.org/A/IN': 10.0.2.3#53
;; resolution failed: broken trust chain
# update-crypto-policies --set DEFAULT:SHA1
# delv ietf.org
; fully validated
ietf.org.		179	IN	A	50.223.129.194
ietf.org.		179	IN	RRSIG	A 5 2 1800 20230512164317 20220512154550 40452 ietf.org. ujh5zmVnBEGATtJu4Or8Aw4Y2mY2d9AFZLHj2qzgD5pDMyfnUeVRIHui IyEhzAHS7sSVOoBg9gXYr//Ol+i0TWc2UTTXwDwZ7iCzSiOdkxSA+CWJ LI4biOi1CR2ypjQAiuOzVRDCOUD1b8zE9z8PUhdWo0J271QqrQ7jMUzZ CTl6mnpgK0eLiY4Yuf1TbE6F7Adl5Yg6YQYq+OBa+1Aeaso/n+jcSgm2 nkHiLTVqUfj3xrCn/KfFTyPi1q3Gb2wnqZQkRBrYvnaoHdRmt1fzw7sf furzw4MbWkCu+jOaVVO74PQ8sCmEABcCjP/3czEVQ6+F4rmpTakrI/x3 QSYFmQ==
# echo "Now unbound-host could return secure result with this change"

Replace podman with docker if you wish.

- Merge PR #660 from Petr Menšík: Sha1 runtime insecure.

pemensik added 2 commits April 8, 2022 16:26

Make SHA-1 signed domains insecure if openssl refuses the digest

6cfcf21

RHEL9/CentOS 9 would fail in default crypto policy. If call to openssl returns invalid digest then report the name insecure. If all tested signatures return the same issue, then make the reply insecure.

Forward indeterminate status higher

33c8baa

Create a path where it can result in insecure.

pemensik force-pushed the sha1-runtime-insecure branch from ca240c7 to 8c12623 Compare April 12, 2022 14:04

Log detailed openssl error also for digests failures

74c6cf5

Make output still only shown in verbose detail. But provide openssl error details to make a reason more obvious.

pemensik force-pushed the sha1-runtime-insecure branch from 8c12623 to 74c6cf5 Compare April 12, 2022 14:13

gthess self-assigned this May 20, 2022

gthess linked an issue Jul 3, 2022 that may be closed by this pull request

[FR] Smart deprecation of SHA-1 signatures #656

Closed

gthess merged commit e102aea into NLnetLabs:master Jul 3, 2022

gthess added a commit that referenced this pull request Jul 3, 2022

Changelog entry for #660

2fba248

- Merge PR #660 from Petr Menšík: Sha1 runtime insecure.

gthess added a commit that referenced this pull request Jul 3, 2022

For #660: formatting, less verbose logging, add EDE information.

317bab9

pemensik mentioned this pull request Oct 19, 2022

WIP: Sha1 runtime unittest #770

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Sha1 runtime insecure #660

Sha1 runtime insecure #660

Uh oh!

pemensik commented Apr 8, 2022

Uh oh!

pemensik commented May 17, 2022

Uh oh!

gthess commented May 20, 2022

Uh oh!

pemensik commented May 23, 2022

Uh oh!

pemensik commented May 24, 2022 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Sha1 runtime insecure #660

Sha1 runtime insecure #660

Uh oh!

Conversation

pemensik commented Apr 8, 2022

Uh oh!

pemensik commented May 17, 2022

Uh oh!

gthess commented May 20, 2022

Uh oh!

pemensik commented May 23, 2022

Uh oh!

pemensik commented May 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

pemensik commented May 24, 2022 •

edited

Loading