From bf5ca4367db99e84bb738a4d9bb261f665b20433 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Fri, 29 Jan 2021 10:17:09 +0100 Subject: [PATCH] libekmfweb: Check length of JWK EC public key coordinates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RFC 7517 requires that the x and y coordinates of a ECC JSON Web Key (JWK) are specified in its full size of a coordinate for the curve used. Signed-off-by: Ingo Franzki Signed-off-by: Jan Höppner --- libekmfweb/cca.c | 12 ++++++++++++ libekmfweb/utilities.c | 10 ++++++++++ 2 files changed, 22 insertions(+) diff --git a/libekmfweb/cca.c b/libekmfweb/cca.c index 411057c7..95e5f133 100644 --- a/libekmfweb/cca.c +++ b/libekmfweb/cca.c @@ -1061,6 +1061,12 @@ int cca_import_key_from_json_web_key(const struct ekmf_cca_lib *cca_lib, pr_verbose(verbose, "Failed to get and decode x"); goto out; } + if (len != prime_len) { + /* RFC 7517: Must be full size of a coordinate */ + pr_verbose(verbose, "x coordinate length is wrong"); + rc = -EINVAL; + goto out; + } len = prime_len; rc = json_object_get_base64url(jwk, "y", &q[1 + prime_len], @@ -1069,6 +1075,12 @@ int cca_import_key_from_json_web_key(const struct ekmf_cca_lib *cca_lib, pr_verbose(verbose, "Failed to get and decode y"); goto out; } + if (len != prime_len) { + /* RFC 7517: Must be full size of a coordinate */ + pr_verbose(verbose, "y coordinate length is wrong"); + rc = -EINVAL; + goto out; + } rule_array_count = 1; memcpy(rule_array, "ECC-PUBL", CCA_KEYWORD_SIZE); diff --git a/libekmfweb/utilities.c b/libekmfweb/utilities.c index c2a40e81..3eaeb293 100644 --- a/libekmfweb/utilities.c +++ b/libekmfweb/utilities.c @@ -2254,11 +2254,21 @@ int json_web_key_as_pkey(json_object *jwk, int pkey_type, EVP_PKEY **pkey) rc = json_object_get_base64url(jwk, "x", x, &len); if (rc != 0) goto out; + if (len != prime_len) { + /* RFC 7517: Must be full size of a coordinate */ + rc = -EINVAL; + goto out; + } len = prime_len; rc = json_object_get_base64url(jwk, "y", y, &len); if (rc != 0) goto out; + if (len != prime_len) { + /* RFC 7517: Must be full size of a coordinate */ + rc = -EINVAL; + goto out; + } rc = ecc_pub_key_as_pkey(nid, prime_len, x, y, pkey); if (rc != 0)