Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

move blinding to __init__ on both RSA public and private #5506

Merged
merged 2 commits into from Oct 26, 2020
Merged

move blinding to __init__ on both RSA public and private #5506

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
453037d
move blinding to __init__ on both RSA public and private
reaperhulk Oct 25, 2020
f038323
change signature to guarantee this test is testing what we think
reaperhulk Oct 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 0 additions & 2 deletions src/cryptography/hazmat/backends/openssl/backend.py
View file
Open in desktop
Expand Up @@ -623,8 +623,6 @@ def load_rsa_private_numbers(self, numbers):
self.openssl_assert(res == 1)
res = self._lib.RSA_set0_crt_params(rsa_cdata, dmp1, dmq1, iqmp)
self.openssl_assert(res == 1)
res = self._lib.RSA_blinding_on(rsa_cdata, self._ffi.NULL)
self.openssl_assert(res == 1)
evp_pkey = self._rsa_cdata_to_evp_pkey(rsa_cdata)

return _RSAPrivateKey(self, rsa_cdata, evp_pkey)
Expand Down
12 changes: 10 additions & 2 deletions src/cryptography/hazmat/backends/openssl/rsa.py
View file
Open in desktop
Expand Up @@ -319,6 +319,11 @@ def __init__(self, backend, rsa_cdata, evp_pkey):
errors = backend._consume_errors_with_text()
raise ValueError("Invalid private key", errors)

# Blinding is on by default in many versions of OpenSSL, but let's
# just be conservative here.
res = backend._lib.RSA_blinding_on(rsa_cdata, backend._ffi.NULL)
backend.openssl_assert(res == 1)

self._backend = backend
self._rsa_cdata = rsa_cdata
self._evp_pkey = evp_pkey
Expand Down Expand Up @@ -351,8 +356,6 @@ def public_key(self):
ctx = self._backend._lib.RSAPublicKey_dup(self._rsa_cdata)
self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
ctx = self._backend._ffi.gc(ctx, self._backend._lib.RSA_free)
res = self._backend._lib.RSA_blinding_on(ctx, self._backend._ffi.NULL)
self._backend.openssl_assert(res == 1)
evp_pkey = self._backend._rsa_cdata_to_evp_pkey(ctx)
return _RSAPublicKey(self._backend, ctx, evp_pkey)

Expand Down Expand Up @@ -411,6 +414,11 @@ def sign(self, data, padding, algorithm):
@utils.register_interface(RSAPublicKeyWithSerialization)
class _RSAPublicKey(object):
def __init__(self, backend, rsa_cdata, evp_pkey):
# Blinding is on by default in many versions of OpenSSL, but let's
# just be conservative here.
res = backend._lib.RSA_blinding_on(rsa_cdata, backend._ffi.NULL)
backend.openssl_assert(res == 1)

self._backend = backend
self._rsa_cdata = rsa_cdata
self._evp_pkey = evp_pkey
Expand Down
12 changes: 1 addition & 11 deletions tests/hazmat/primitives/test_rsa.py
View file
Open in desktop
Expand Up @@ -950,17 +950,7 @@ def test_invalid_pss_signature_data_too_large_for_modulus(self, backend):
b"cb43bde4f7ab89eb4a79c6e8dd67e0d1af60715da64429d90c716a490b799c29"
b"194cf8046509c6ed851052367a74e2e92d9b38947ed74332acb115a03fcc0222"
)
public_key = rsa.RSAPublicNumbers(
n=int(
b"381201f4905d67dfeb3dec131a0fbea773489227ec7a1448c3109189ac68"
b"5a95441be90866a14c4d2e139cd16db540ec6c7abab13ffff91443fd46a8"
b"960cbb7658ded26a5c95c86f6e40384e1c1239c63e541ba221191c4dd303"
b"231b42e33c6dbddf5ec9a746f09bf0c25d0f8d27f93ee0ae5c0d723348f4"
b"030d3581e13522",
16,
),
e=65537,
).public_key(backend)
public_key = RSA_KEY_1024.private_key(backend).public_key()
with pytest.raises(InvalidSignature):
public_key.verify(
signature,
Expand Down