Validate ServerKeyExchange signature algorithm (TLS 1.2+)

peterdettman · peterdettman · commit 1175209f5100 · 2015-12-16T23:09:12.000+07:00
- check the algorithm is in signature_algorithms (or the implicit
defaults if that extension was not sent)
- add (D)TLS test scenarios to cover these checks
diff --git a/crypto/src/crypto/tls/AbstractTlsKeyExchange.cs b/crypto/src/crypto/tls/AbstractTlsKeyExchange.cs
@@ -18,6 +18,17 @@ protected AbstractTlsKeyExchange(int keyExchange, IList supportedSignatureAlgori
             this.mSupportedSignatureAlgorithms = supportedSignatureAlgorithms;
         }
 
+        protected virtual DigitallySigned ParseSignature(Stream input)
+        {
+            DigitallySigned signature = DigitallySigned.Parse(mContext, input);
+            SignatureAndHashAlgorithm signatureAlgorithm = signature.Algorithm;
+            if (signatureAlgorithm != null)
+            {
+                TlsUtilities.VerifySupportedSignatureAlgorithm(mSupportedSignatureAlgorithms, signatureAlgorithm);
+            }
+            return signature;
+        }
+
         public virtual void Init(TlsContext context)
         {
             this.mContext = context;
diff --git a/crypto/src/crypto/tls/TlsDheKeyExchange.cs b/crypto/src/crypto/tls/TlsDheKeyExchange.cs
@@ -71,7 +71,7 @@ public override void ProcessServerKeyExchange(Stream input)
 
             ServerDHParams dhParams = ServerDHParams.Parse(teeIn);
 
-            DigitallySigned signed_params = DigitallySigned.Parse(mContext, input);
+            DigitallySigned signed_params = ParseSignature(input);
 
             ISigner signer = InitVerifyer(mTlsSigner, signed_params.Algorithm, securityParameters);
             buf.UpdateSigner(signer);
diff --git a/crypto/src/crypto/tls/TlsECDheKeyExchange.cs b/crypto/src/crypto/tls/TlsECDheKeyExchange.cs
@@ -73,7 +73,7 @@ public override void ProcessServerKeyExchange(Stream input)
 
             byte[] point = TlsUtilities.ReadOpaque8(teeIn);
 
-            DigitallySigned signed_params = DigitallySigned.Parse(mContext, input);
+            DigitallySigned signed_params = ParseSignature(input);
 
             ISigner signer = InitVerifyer(mTlsSigner, signed_params.Algorithm, securityParameters);
             buf.UpdateSigner(signer);
diff --git a/crypto/src/crypto/tls/TlsSrpKeyExchange.cs b/crypto/src/crypto/tls/TlsSrpKeyExchange.cs
@@ -189,7 +189,7 @@ public override void ProcessServerKeyExchange(Stream input)
 
             if (buf != null)
             {
-                DigitallySigned signed_params = DigitallySigned.Parse(mContext, input);
+                DigitallySigned signed_params = ParseSignature(input);
 
                 ISigner signer = InitVerifyer(mTlsSigner, signed_params.Algorithm, securityParameters);
                 buf.UpdateSigner(signer);
diff --git a/crypto/test/src/crypto/tls/test/DtlsTestSuite.cs b/crypto/test/src/crypto/tls/test/DtlsTestSuite.cs
@@ -149,6 +149,35 @@ private static void AddVersionTests(IList testSuite, ProtocolVersion version)
 
                 AddTestCase(testSuite, c, prefix + "BadMandatoryCertReqDeclined");
             }
+
+            /*
+             * Server selects MD5/RSA for ServerKeyExchange signature, which is not in the default
+             * supported signature algorithms that the client sent. We expect fatal alert from the
+             * client when it verifies the selected algorithm against the supported algorithms.
+             */
+            if (TlsUtilities.IsTlsV12(version))
+            {
+                TlsTestConfig c = CreateDtlsTestConfig(version);
+                c.serverAuthSigAlg = new SignatureAndHashAlgorithm(HashAlgorithm.md5, SignatureAlgorithm.rsa);
+                c.ExpectClientFatalAlert(AlertDescription.illegal_parameter);
+
+                AddTestCase(testSuite, c, prefix + "BadServerKeyExchangeSigAlg");
+            }
+
+            /*
+             * Server selects MD5/RSA for ServerKeyExchange signature, which is not the default {sha1,rsa}
+             * implied by the absent signature_algorithms extension. We expect fatal alert from the
+             * client when it verifies the selected algorithm against the implicit default.
+             */
+            if (TlsUtilities.IsTlsV12(version))
+            {
+                TlsTestConfig c = CreateDtlsTestConfig(version);
+                c.clientSendSignatureAlgorithms = false;
+                c.serverAuthSigAlg = new SignatureAndHashAlgorithm(HashAlgorithm.md5, SignatureAlgorithm.rsa);
+                c.ExpectClientFatalAlert(AlertDescription.illegal_parameter);
+
+                AddTestCaseDebug(testSuite, c, prefix + "BadServerKeyExchangeSigAlg2");
+            }
 #endif
 
             {
@@ -173,6 +202,11 @@ private static void AddVersionTests(IList testSuite, ProtocolVersion version)
         }
 
         private static void AddTestCase(IList testSuite, TlsTestConfig config, String name)
+        {
+            //testSuite.Add(new TestCaseData(config).SetName(name));
+        }
+
+        private static void AddTestCaseDebug(IList testSuite, TlsTestConfig config, String name)
         {
             testSuite.Add(new TestCaseData(config).SetName(name));
         }
diff --git a/crypto/test/src/crypto/tls/test/TlsTestClientImpl.cs b/crypto/test/src/crypto/tls/test/TlsTestClientImpl.cs
@@ -57,6 +57,17 @@ public override ProtocolVersion MinimumVersion
 	        }
         }
 
+        public override IDictionary GetClientExtensions()
+        {
+            IDictionary clientExtensions = base.GetClientExtensions();
+            if (clientExtensions != null && !mConfig.clientSendSignatureAlgorithms)
+            {
+                clientExtensions.Remove(ExtensionType.signature_algorithms);
+                this.mSupportedSignatureAlgorithms = null;
+            }
+            return clientExtensions;
+        }
+
         public override bool IsFallback
         {
             get { return mConfig.clientFallback; }
diff --git a/crypto/test/src/crypto/tls/test/TlsTestConfig.cs b/crypto/test/src/crypto/tls/test/TlsTestConfig.cs
@@ -74,6 +74,17 @@ public class TlsTestConfig
          */
         public bool clientFallback = false;
 
+        /**
+         * Configures whether a (TLS 1.2+) client will send the signature_algorithms extension in ClientHello.
+         */
+        public bool clientSendSignatureAlgorithms = true;
+
+        /**
+         * If not null, and TLS 1.2 or higher is negotiated, selects a fixed signature/hash algorithm to
+         * be used for the ServerKeyExchange signature (if one is sent).
+         */
+        public SignatureAndHashAlgorithm serverAuthSigAlg = null;
+
         /**
          * Configures whether the test server will send a certificate request.
          */
diff --git a/crypto/test/src/crypto/tls/test/TlsTestServerImpl.cs b/crypto/test/src/crypto/tls/test/TlsTestServerImpl.cs
@@ -172,15 +172,27 @@ public override void NotifyClientCertificate(Certificate clientCertificate)
             }
         }
 
+        protected virtual IList GetSupportedSignatureAlgorithms()
+        {
+            if (TlsUtilities.IsTlsV12(mContext) && mConfig.serverAuthSigAlg != null)
+            {
+                IList signatureAlgorithms = new ArrayList(1);
+                signatureAlgorithms.Add(mConfig.serverAuthSigAlg);
+                return signatureAlgorithms;
+            }
+
+            return mSupportedSignatureAlgorithms;
+        }
+
         protected override TlsSignerCredentials GetDsaSignerCredentials()
         {
-            return TlsTestUtilities.LoadSignerCredentials(mContext, mSupportedSignatureAlgorithms, SignatureAlgorithm.dsa,
+            return TlsTestUtilities.LoadSignerCredentials(mContext, GetSupportedSignatureAlgorithms(), SignatureAlgorithm.dsa,
                 "x509-server-dsa.pem", "x509-server-key-dsa.pem");
         }
 
         protected override TlsSignerCredentials GetECDsaSignerCredentials()
         {
-            return TlsTestUtilities.LoadSignerCredentials(mContext, mSupportedSignatureAlgorithms, SignatureAlgorithm.ecdsa,
+            return TlsTestUtilities.LoadSignerCredentials(mContext, GetSupportedSignatureAlgorithms(), SignatureAlgorithm.ecdsa,
                 "x509-server-ecdsa.pem", "x509-server-key-ecdsa.pem");
         }
 
@@ -192,7 +204,7 @@ protected override TlsEncryptionCredentials GetRsaEncryptionCredentials()
 
         protected override TlsSignerCredentials GetRsaSignerCredentials()
         {
-            return TlsTestUtilities.LoadSignerCredentials(mContext, mSupportedSignatureAlgorithms, SignatureAlgorithm.rsa,
+            return TlsTestUtilities.LoadSignerCredentials(mContext, GetSupportedSignatureAlgorithms(), SignatureAlgorithm.rsa,
                 "x509-server.pem", "x509-server-key.pem");
         }
 
diff --git a/crypto/test/src/crypto/tls/test/TlsTestSuite.cs b/crypto/test/src/crypto/tls/test/TlsTestSuite.cs
@@ -142,6 +142,35 @@ private static void AddVersionTests(IList testSuite, ProtocolVersion version)
                 AddTestCase(testSuite, c, prefix + "BadMandatoryCertReqDeclined");
             }
 
+            /*
+             * Server selects MD5/RSA for ServerKeyExchange signature, which is not in the default
+             * supported signature algorithms that the client sent. We expect fatal alert from the
+             * client when it verifies the selected algorithm against the supported algorithms.
+             */
+            if (TlsUtilities.IsTlsV12(version))
+            {
+                TlsTestConfig c = CreateTlsTestConfig(version);
+                c.serverAuthSigAlg = new SignatureAndHashAlgorithm(HashAlgorithm.md5, SignatureAlgorithm.rsa);
+                c.ExpectClientFatalAlert(AlertDescription.illegal_parameter);
+
+                AddTestCase(testSuite, c, prefix + "BadServerKeyExchangeSigAlg");
+            }
+
+            /*
+             * Server selects MD5/RSA for ServerKeyExchange signature, which is not the default {sha1,rsa}
+             * implied by the absent signature_algorithms extension. We expect fatal alert from the
+             * client when it verifies the selected algorithm against the implicit default.
+             */
+            if (TlsUtilities.IsTlsV12(version))
+            {
+                TlsTestConfig c = CreateTlsTestConfig(version);
+                c.clientSendSignatureAlgorithms = false;
+                c.serverAuthSigAlg = new SignatureAndHashAlgorithm(HashAlgorithm.md5, SignatureAlgorithm.rsa);
+                c.ExpectClientFatalAlert(AlertDescription.illegal_parameter);
+
+                AddTestCase(testSuite, c, prefix + "BadServerKeyExchangeSigAlg2");
+            }
+
             {
                 TlsTestConfig c = CreateTlsTestConfig(version);
                 c.serverCertReq = C.SERVER_CERT_REQ_NONE;

Original file line number	Diff line number	Diff line change
`@@ -189,7 +189,7 @@ public override void ProcessServerKeyExchange(Stream input)`
`189`	`189`
`190`	`190`	`if (buf != null)`
`191`	`191`	`{`
`192`		`- DigitallySigned signed_params = DigitallySigned.Parse(mContext, input);`
	`192`	`+ DigitallySigned signed_params = ParseSignature(input);`
`193`	`193`
`194`	`194`	`ISigner signer = InitVerifyer(mTlsSigner, signed_params.Algorithm, securityParameters);`
`195`	`195`	`buf.UpdateSigner(signer);`
Original file line number	Diff line number	Diff line change
`@@ -57,6 +57,17 @@ public override ProtocolVersion MinimumVersion`
`57`	`57`	`}`
`58`	`58`	`}`
`59`	`59`
	`60`	`+ public override IDictionary GetClientExtensions()`
	`61`	`+ {`
	`62`	`+ IDictionary clientExtensions = base.GetClientExtensions();`
	`63`	`+ if (clientExtensions != null && !mConfig.clientSendSignatureAlgorithms)`
	`64`	`+ {`
	`65`	`+ clientExtensions.Remove(ExtensionType.signature_algorithms);`
	`66`	`+ this.mSupportedSignatureAlgorithms = null;`
	`67`	`+ }`
	`68`	`+ return clientExtensions;`
	`69`	`+ }`
	`70`	`+`
`60`	`71`	`public override bool IsFallback`
`61`	`72`	`{`
`62`	`73`	`get { return mConfig.clientFallback; }`
Original file line number	Diff line number	Diff line change
`@@ -172,15 +172,27 @@ public override void NotifyClientCertificate(Certificate clientCertificate)`
`172`	`172`	`}`
`173`	`173`	`}`
`174`	`174`
	`175`	`+ protected virtual IList GetSupportedSignatureAlgorithms()`
	`176`	`+ {`
	`177`	`+ if (TlsUtilities.IsTlsV12(mContext) && mConfig.serverAuthSigAlg != null)`
	`178`	`+ {`
	`179`	`+ IList signatureAlgorithms = new ArrayList(1);`
	`180`	`+ signatureAlgorithms.Add(mConfig.serverAuthSigAlg);`
	`181`	`+ return signatureAlgorithms;`
	`182`	`+ }`
	`183`	`+`
	`184`	`+ return mSupportedSignatureAlgorithms;`
	`185`	`+ }`
	`186`	`+`
`175`	`187`	`protected override TlsSignerCredentials GetDsaSignerCredentials()`
`176`	`188`	`{`
`177`		`- return TlsTestUtilities.LoadSignerCredentials(mContext, mSupportedSignatureAlgorithms, SignatureAlgorithm.dsa,`
	`189`	`+ return TlsTestUtilities.LoadSignerCredentials(mContext, GetSupportedSignatureAlgorithms(), SignatureAlgorithm.dsa,`
`178`	`190`	`"x509-server-dsa.pem", "x509-server-key-dsa.pem");`
`179`	`191`	`}`
`180`	`192`
`181`	`193`	`protected override TlsSignerCredentials GetECDsaSignerCredentials()`
`182`	`194`	`{`
`183`		`- return TlsTestUtilities.LoadSignerCredentials(mContext, mSupportedSignatureAlgorithms, SignatureAlgorithm.ecdsa,`
	`195`	`+ return TlsTestUtilities.LoadSignerCredentials(mContext, GetSupportedSignatureAlgorithms(), SignatureAlgorithm.ecdsa,`
`184`	`196`	`"x509-server-ecdsa.pem", "x509-server-key-ecdsa.pem");`
`185`	`197`	`}`
`186`	`198`
`@@ -192,7 +204,7 @@ protected override TlsEncryptionCredentials GetRsaEncryptionCredentials()`
`192`	`204`
`193`	`205`	`protected override TlsSignerCredentials GetRsaSignerCredentials()`
`194`	`206`	`{`
`195`		`- return TlsTestUtilities.LoadSignerCredentials(mContext, mSupportedSignatureAlgorithms, SignatureAlgorithm.rsa,`
	`207`	`+ return TlsTestUtilities.LoadSignerCredentials(mContext, GetSupportedSignatureAlgorithms(), SignatureAlgorithm.rsa,`
`196`	`208`	`"x509-server.pem", "x509-server-key.pem");`
`197`	`209`	`}`
`198`	`210`