openssl3/contribs10/0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch

From 754862899058cfb5f2341c81f9e04dd2f7b37056 Mon Sep 17 00:00:00 2001
From: Clemens Lang <cllang@redhat.com>
Date: Thu, 17 Nov 2022 18:37:17 +0100
Subject: [PATCH] pbkdf2: Set minimum password length of 8 bytes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Implementation Guidance for FIPS 140-3 says in section D.N
"Password-Based Key Derivation for Storage Applications" that "the
vendor shall document in the module’s Security Policy the length of
a password/passphrase used in key derivation and establish an upper
bound for the probability of having this parameter guessed at random.
This probability shall take into account not only the length of the
password/passphrase, but also the difficulty of guessing it. The
decision on the minimum length of a password used for key derivation is
the vendor’s, but the vendor shall at a minimum informally justify the
decision."

We are choosing a minimum password length of 8 bytes, because NIST's
ACVP testing uses passwords as short as 8 bytes, and requiring longer
passwords combined with an implicit indicator (i.e., returning an error)
would cause the module to fail ACVP testing.

Signed-off-by: Clemens Lang <cllang@redhat.com>
---
 providers/implementations/kdfs/pbkdf2.c | 27 ++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/providers/implementations/kdfs/pbkdf2.c b/providers/implementations/kdfs/pbkdf2.c
index 2a0ae63acc..aa0adce5e6 100644
--- a/providers/implementations/kdfs/pbkdf2.c
+++ b/providers/implementations/kdfs/pbkdf2.c
@@ -35,6 +35,21 @@
 #define KDF_PBKDF2_MAX_KEY_LEN_DIGEST_RATIO 0xFFFFFFFF
 #define KDF_PBKDF2_MIN_ITERATIONS 1000
 #define KDF_PBKDF2_MIN_SALT_LEN   (128 / 8)
+/* The Implementation Guidance for FIPS 140-3 says in section D.N
+ * "Password-Based Key Derivation for Storage Applications" that "the vendor
+ * shall document in the module’s Security Policy the length of
+ * a password/passphrase used in key derivation and establish an upper bound
+ * for the probability of having this parameter guessed at random. This
+ * probability shall take into account not only the length of the
+ * password/passphrase, but also the difficulty of guessing it. The decision on
+ * the minimum length of a password used for key derivation is the vendor’s,
+ * but the vendor shall at a minimum informally justify the decision."
+ *
+ * We are choosing a minimum password length of 8 bytes, because NIST's ACVP
+ * testing uses passwords as short as 8 bytes, and requiring longer passwords
+ * combined with an implicit indicator (i.e., returning an error) would cause
+ * the module to fail ACVP testing. */
+#define KDF_PBKDF2_MIN_PASSWORD_LEN (8)
 
 static OSSL_FUNC_kdf_newctx_fn kdf_pbkdf2_new;
 static OSSL_FUNC_kdf_freectx_fn kdf_pbkdf2_free;
@@ -186,9 +201,15 @@ static int kdf_pbkdf2_set_ctx_params(void *vctx, const OSSL_PARAM params[])
         ctx->lower_bound_checks = pkcs5 == 0;
     }
 
-    if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL)
+    if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL) {
+        if (ctx->lower_bound_checks != 0
+            && p->data_size < KDF_PBKDF2_MIN_PASSWORD_LEN) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
+            return 0;
+        }
         if (!pbkdf2_set_membuf(&ctx->pass, &ctx->pass_len, p))
             return 0;
+    }
 
     if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) {
         if (ctx->lower_bound_checks != 0
@@ -297,6 +318,10 @@ static int pbkdf2_derive(const char *pass, size_t passlen,
     }
 
     if (lower_bound_checks) {
+        if (passlen < KDF_PBKDF2_MIN_PASSWORD_LEN) {
+            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
+            return 0;
+        }
         if ((keylen * 8) < KDF_PBKDF2_MIN_KEY_LEN_BITS) {
             ERR_raise(ERR_LIB_PROV, PROV_R_KEY_SIZE_TOO_SMALL);
             return 0;
-- 
2.38.1

1	From 754862899058cfb5f2341c81f9e04dd2f7b37056 Mon Sep 17 00:00:00 2001
2	From: Clemens Lang <cllang@redhat.com>
3	Date: Thu, 17 Nov 2022 18:37:17 +0100
4	Subject: [PATCH] pbkdf2: Set minimum password length of 8 bytes
5	MIME-Version: 1.0
6	Content-Type: text/plain; charset=UTF-8
7	Content-Transfer-Encoding: 8bit
8
9	The Implementation Guidance for FIPS 140-3 says in section D.N
10	"Password-Based Key Derivation for Storage Applications" that "the
11	vendor shall document in the module’s Security Policy the length of
12	a password/passphrase used in key derivation and establish an upper
13	bound for the probability of having this parameter guessed at random.
14	This probability shall take into account not only the length of the
15	password/passphrase, but also the difficulty of guessing it. The
16	decision on the minimum length of a password used for key derivation is
17	the vendor’s, but the vendor shall at a minimum informally justify the
18	decision."
19
20	We are choosing a minimum password length of 8 bytes, because NIST's
21	ACVP testing uses passwords as short as 8 bytes, and requiring longer
22	passwords combined with an implicit indicator (i.e., returning an error)
23	would cause the module to fail ACVP testing.
24
25	Signed-off-by: Clemens Lang <cllang@redhat.com>
26	---
27	providers/implementations/kdfs/pbkdf2.c \| 27 ++++++++++++++++++++++++-
28	1 file changed, 26 insertions(+), 1 deletion(-)
29
30	diff --git a/providers/implementations/kdfs/pbkdf2.c b/providers/implementations/kdfs/pbkdf2.c
31	index 2a0ae63acc..aa0adce5e6 100644
32	--- a/providers/implementations/kdfs/pbkdf2.c
33	+++ b/providers/implementations/kdfs/pbkdf2.c
34	@@ -35,6 +35,21 @@
35	#define KDF_PBKDF2_MAX_KEY_LEN_DIGEST_RATIO 0xFFFFFFFF
36	#define KDF_PBKDF2_MIN_ITERATIONS 1000
37	#define KDF_PBKDF2_MIN_SALT_LEN (128 / 8)
38	+/* The Implementation Guidance for FIPS 140-3 says in section D.N
39	+ * "Password-Based Key Derivation for Storage Applications" that "the vendor
40	+ * shall document in the module’s Security Policy the length of
41	+ * a password/passphrase used in key derivation and establish an upper bound
42	+ * for the probability of having this parameter guessed at random. This
43	+ * probability shall take into account not only the length of the
44	+ * password/passphrase, but also the difficulty of guessing it. The decision on
45	+ * the minimum length of a password used for key derivation is the vendor’s,
46	+ * but the vendor shall at a minimum informally justify the decision."
47	+ *
48	+ * We are choosing a minimum password length of 8 bytes, because NIST's ACVP
49	+ * testing uses passwords as short as 8 bytes, and requiring longer passwords
50	+ * combined with an implicit indicator (i.e., returning an error) would cause
51	+ * the module to fail ACVP testing. */
52	+#define KDF_PBKDF2_MIN_PASSWORD_LEN (8)
53
54	static OSSL_FUNC_kdf_newctx_fn kdf_pbkdf2_new;
55	static OSSL_FUNC_kdf_freectx_fn kdf_pbkdf2_free;
56	@@ -186,9 +201,15 @@ static int kdf_pbkdf2_set_ctx_params(void *vctx, const OSSL_PARAM params[])
57	ctx->lower_bound_checks = pkcs5 == 0;
58	}
59
60	- if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL)
61	+ if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_PASSWORD)) != NULL) {
62	+ if (ctx->lower_bound_checks != 0
63	+ && p->data_size < KDF_PBKDF2_MIN_PASSWORD_LEN) {
64	+ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
65	+ return 0;
66	+ }
67	if (!pbkdf2_set_membuf(&ctx->pass, &ctx->pass_len, p))
68	return 0;
69	+ }
70
71	if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SALT)) != NULL) {
72	if (ctx->lower_bound_checks != 0
73	@@ -297,6 +318,10 @@ static int pbkdf2_derive(const char *pass, size_t passlen,
74	}
75
76	if (lower_bound_checks) {
77	+ if (passlen < KDF_PBKDF2_MIN_PASSWORD_LEN) {
78	+ ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
79	+ return 0;
80	+ }
81	if ((keylen * 8) < KDF_PBKDF2_MIN_KEY_LEN_BITS) {
82	ERR_raise(ERR_LIB_PROV, PROV_R_KEY_SIZE_TOO_SMALL);
83	return 0;
84	--
85	2.38.1
86