lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v6] KEYS: encrypted: fix key instantiation with user-provided data
From
Date
On Wed, 2022-10-19 at 18:38 +0200, Nikolaus Voss wrote:
> Commit cd3bc044af48 ("KEYS: encrypted: Instantiate key with
> user-provided decrypted data") added key instantiation with user
> provided decrypted data. The user data is hex-ascii-encoded but was
> just memcpy'ed to the binary buffer. Fix this to use hex2bin instead.
>
> Old keys created from user provided decrypted data saved with "keyctl
> pipe" are still valid, however if the key is recreated from decrypted
> data the old key must be converted to the correct format. This can be
> done with a small shell script, e.g.:
>
> BROKENKEY=abcdefABCDEF1234567890aaaaaaaaaa
> NEWKEY=$(echo -ne $BROKENKEY | xxd -p -c32)
> keyctl add user masterkey "$(cat masterkey.bin)" @u
> keyctl add encrypted testkey "new user:masterkey 32 $NEWKEY" @u
>
> However, NEWKEY is still broken: If for BROKENKEY 32 bytes were
> specified, a brute force attacker knowing the key properties would only
> need to try at most 2^(16*8) keys, as if the key was only 16 bytes long.
>
> The security issue is a result of the combination of limiting the input
> range to hex-ascii and using memcpy() instead of hex2bin(). It could
> have been fixed either by allowing binary input or using hex2bin() (and
> doubling the ascii input key length). This patch implements the latter.
>
> The corresponding test for the Linux Test Project ltp has also been
> fixed (see link below).
>
> Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data")
> Cc: stable@kernel.org
> Link: https://lore.kernel.org/ltp/20221006081709.92303897@mail.steuer-voss.de/
> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
> Signed-off-by: Nikolaus Voss <nikolaus.voss@haag-streit.com>

Thanks! This patch is now queued in next-integrity/next-integrity-
testing.

--
thanks,

Mimi

\
 
 \ /
  Last update: 2022-10-19 23:29    [W:0.953 / U:0.824 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site