From: Filippo Valsorda <filippo@golang.org>
Date: Wed, 8 Apr 2020 21:49:06 +0000 (-0400)
Subject: [dev.boringcrypto] crypto/internal/boring: reject short signatures in VerifyRSAPKCS1v15
X-Git-Tag: go1.19beta1~484^2~83
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=36c94f842143782819933224a03afc990d1371ce;p=gostls13.git

[dev.boringcrypto] crypto/internal/boring: reject short signatures in VerifyRSAPKCS1v15

This matches the new crypto/rsa behavior introduced in CL 226203.

Updates #21896

Change-Id: If04eeff933d7310c2baa0f8fd26907892c2397fd
Reviewed-on: https://go-review.googlesource.com/c/go/+/227651
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
---

diff --git a/src/crypto/internal/boring/rsa.go b/src/crypto/internal/boring/rsa.go
index 9f4f53e0d8..a10831dd00 100644
--- a/src/crypto/internal/boring/rsa.go
+++ b/src/crypto/internal/boring/rsa.go
@@ -320,19 +320,11 @@ func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte) ([]byte,
 }
 
 func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte) error {
-	size := int(pub.withKey(func(key *C.GO_RSA) C.int {
-		return C.int(C._goboringcrypto_RSA_size(key))
-	}))
-	if len(sig) < size {
-		// BoringCrypto requires sig to be same size as RSA key, so pad with leading zeros.
-		zsig := make([]byte, size)
-		copy(zsig[len(zsig)-len(sig):], sig)
-		sig = zsig
-	}
 	if h == 0 {
+		var out []byte
 		var outLen C.size_t
-		out := make([]byte, size)
 		if pub.withKey(func(key *C.GO_RSA) C.int {
+			out = make([]byte, C._goboringcrypto_RSA_size(key))
 			return C._goboringcrypto_RSA_verify_raw(key, &outLen, base(out),
 				C.size_t(len(out)), base(sig), C.size_t(len(sig)), C.GO_RSA_PKCS1_PADDING)
 		}) == 0 {
diff --git a/src/crypto/rsa/boring_test.go b/src/crypto/rsa/boring_test.go
index 26fdabb197..11dcdf88fd 100644
--- a/src/crypto/rsa/boring_test.go
+++ b/src/crypto/rsa/boring_test.go
@@ -48,9 +48,7 @@ func TestBoringDeepEqual(t *testing.T) {
 }
 
 func TestBoringVerify(t *testing.T) {
-	// This changed behavior and broke golang.org/x/crypto/openpgp.
-	// Go accepts signatures without leading 0 padding, while BoringCrypto does not.
-	// So the Go wrappers must adapt.
+	// Check that signatures that lack leading zeroes don't verify.
 	key := &PublicKey{
 		N: bigFromHex("c4fdf7b40a5477f206e6ee278eaef888ca73bf9128a9eef9f2f1ddb8b7b71a4c07cfa241f028a04edb405e4d916c61d6beabc333813dc7b484d2b3c52ee233c6a79b1eea4e9cc51596ba9cd5ac5aeb9df62d86ea051055b79d03f8a4fa9f38386f5bd17529138f3325d46801514ea9047977e0829ed728e68636802796801be1"),
 		E: 65537,
@@ -63,13 +61,13 @@ func TestBoringVerify(t *testing.T) {
 	sig := fromHex("5edfbeb6a73e7225ad3cc52724e2872e04260d7daf0d693c170d8c4b243b8767bc7785763533febc62ec2600c30603c433c095453ede59ff2fcabeb84ce32e0ed9d5cf15ffcbc816202b64370d4d77c1e9077d74e94a16fb4fa2e5bec23a56d7a73cf275f91691ae1801a976fcde09e981a2f6327ac27ea1fecf3185df0d56")
 
 	err := VerifyPKCS1v15(key, 0, paddedHash, sig)
-	if err != nil {
-		t.Errorf("raw: %v", err)
+	if err == nil {
+		t.Errorf("raw: expected verification error")
 	}
 
 	err = VerifyPKCS1v15(key, crypto.SHA1, hash, sig)
-	if err != nil {
-		t.Errorf("sha1: %v", err)
+	if err == nil {
+		t.Errorf("sha1: expected verification error")
 	}
 }