Wanted: PyCrypto security advisories

--ZGiS0Q5IWpPtfppv
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Dec 13, 2009 at 03:59:34PM -0500, Dwayne C. Litzenberger wrote:
> PyCrypto 2.1.0 has been released.

This release of PyCrypto fixes a number of issues, but the previous=20
release, version 2.0.1 is still widely deployed.

I'm a terrible maintainer with too many half-baked projects on the go.  It=
=20
would be great if someone familiar with making security advisories went=20
through this release, acquired CVE numbers where appropriate, and issued=20
security advisories for bugs in PyCrypto 2.0.1 and in software that uses it=
=20
incorrectly.

I'm an advocate of full disclosure, so if you find any additional problems=
=20
that haven't been fixed yet, please just file a bug on Launchpad and make=
=20
whatever other announcements you deem necessary.  I don't think I have some=
=20
inherent right to know about exploitable vulnerabilities in other people's=
=20
computers before they do, just because I happen to be (badly) maintaining=
=20
some software they use.  (Please also consider supporting=20
http://wikileaks.org/.)

Here are some highlights from the changelog, with my comments:

> 	  - Implemented __ne__() on pubkey, which fixes the following=20
> 	  broken behaviour:
> 	        >>> pk.publickey() =3D=3D pk.publickey()
> 	        True
> 	        >>> pk.publickey() !=3D pk.publickey()
> 	        True
> 	    (patch from Lorenz Quack)

This isn't a security hole in PyCrypto, but I wonder if other software=20
breaks, due to PyCrypto violating the expectations of application=20
developers.

> 	  - Fixed padding bug in SHA256; this resulted in bad digests=20
> 	  whenever (the number of bytes hashed) mod 64 =3D=3D 55.

I think some distros (e.g. Debian) had this fixed already.  At minimum,=20
this is a compatibility problem.  Maybe it's also a security hole; I'm not=
=20
a cryptanalyst, so I don't know.

> 	  - Fixed a bad behaviour of the XOR cipher module: It would=20
> 	  silently truncate all keys to 32 bytes.  Now it raises ValueError=20
> 	  when the key is too long.

Code that used Crypto.Cipher.XOR to XOR two long strings together would=20
fail silently.  If your code raises a ValueError here after upgrading to=20
PyCrypto 2.1.0, then you have a security hole.

> 	  - Fixed the winrandom module, which had been omitted from the=20
> 	  build process, causing security problems for programs that misuse=20
> 	  RandomPool.

In the code I've seen, misusing RandomPool is almost universal.  Someone=20
can probably generate a bunch of advisories just by searching Google Code=
=20
Search for "RandomPool".

See https://bugs.launchpad.net/pycrypto/+bug/249765, and follow the links.

> 	* Modified RSA.generate() to ensure that e is coprime to p-1 and=20
> 	q-1. Apparently, RSA.generate was capable of generating unusable=20
> 	keys.

I don't quite understand the security impact of this (if any), but it was=
=20
reported here:

     https://bugs.launchpad.net/pycrypto/+bug/408660

=3D =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D =3D

Here are some quick links:

PyCrypto 2.1.0 release announcement:
     http://lists.dlitz.net/pipermail/pycrypto/2009q4/000169.html
Bug tracker:
     https://bugs.launchpad.net/pycrypto
Website:
     http://www.pycrypto.org/
git repo:
     git://git.pycrypto.org:9419/crypto/pycrypto-2.x.git
gitweb:
     http://gitweb.pycrypto.org/?p=3Dcrypto/pycrypto-2.x.git

Cheers,
- Dwayne

--=20
Dwayne C. Litzenberger <[email protected]>
  Key-signing key   - 19E1 1FE8 B3CF F273 ED17  4A24 928C EC13 39C2 5CF7
  Annual key (2009) - C805 1746 397B 0202 2758  2821 58E0 894B 81D2 582E

--ZGiS0Q5IWpPtfppv
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iFYEAREKAAYFAksnIvUACgkQWOCJS4HSWC7CJwDfaKSx8ulSrCC9TrsSwfEKKPPa
iEo3iQkXAjPT0gDfU6jGsPgtPK2xfMyJv+mUbrfr9KdnU+6f9Fx9ig==
=7/fG
-----END PGP SIGNATURE-----

--ZGiS0Q5IWpPtfppv--