Skip to content

Instantly share code, notes, and snippets.

@kgbu
Last active August 29, 2015 14:07
Show Gist options
  • Select an option

  • Save kgbu/6a535e58643548818f3f to your computer and use it in GitHub Desktop.

Select an option

Save kgbu/6a535e58643548818f3f to your computer and use it in GitHub Desktop.
on Reddit rumor - OpenSSL bug allows RSA 1024 key factorization in 20 minutes

on Reddit rumor - OpenSSL bug allows RSA 1024 key factorization in 20 minutes

see discussion on this case https://www.reddit.com/r/crypto/comments/2i9qke/openssl_bug_allows_rsa_1024_key_factorization_in/

2 lines of suspected codes are located in line 227 and 228 in https://github.com/openssl/openssl/blob/master/crypto/rsa/rsa_gen.c#L227

test code

$ cat a.c
#include <stdio.h>
int main() {
  int bits = 1024;
  int bitsp, bitsq;

  bitsp=(bits+1)/2;
  bitsq=bits-bitsp;

  printf("bits %d, bitsp %d, bitsq %d\n", bits, bitsp, bitsq);
 
}

environment (OSX 10.9)

$ gcc --version
Configured with: --prefix=/Applications/Xcode.app/Contents/Developer/usr --with-gxx-include-dir=/usr/include/c++/4.2.1
Apple LLVM version 6.0 (clang-600.0.51) (based on LLVM 3.5svn)
Target: x86_64-apple-darwin13.4.0
Thread model: posix

confirm assmbler code (for x86_64)

idivl op-code is used for division idivl s means; signed divide of %edx::%eax by s; quotient in %eax, remainder in%edx .

$ gcc -S a.c
$ cat a.s
	.section	__TEXT,__text,regular,pure_instructions
	.globl	_main
	.align	4, 0x90
_main:                                  ## @main
	.cfi_startproc
## BB#0:
	pushq	%rbp
Ltmp2:
	.cfi_def_cfa_offset 16
Ltmp3:
	.cfi_offset %rbp, -16
	movq	%rsp, %rbp
Ltmp4:
	.cfi_def_cfa_register %rbp
	subq	$32, %rsp
	leaq	L_.str(%rip), %rdi
	movl	$2, %eax
	movl	$1024, -4(%rbp)         ## imm = 0x400
	movl	-4(%rbp), %ecx
	addl	$1, %ecx
	movl	%eax, -16(%rbp)         ## 4-byte Spill
	movl	%ecx, %eax
	cltd
	movl	-16(%rbp), %ecx         ## 4-byte Reload
	idivl	%ecx
	movl	%eax, -8(%rbp)
	movl	-4(%rbp), %eax
	subl	-8(%rbp), %eax
	movl	%eax, -12(%rbp)
	movl	-4(%rbp), %esi
	movl	-8(%rbp), %edx
	movl	-12(%rbp), %ecx
	movb	$0, %al
	callq	_printf
	movl	$0, %ecx
	movl	%eax, -20(%rbp)         ## 4-byte Spill
	movl	%ecx, %eax
	addq	$32, %rsp
	popq	%rbp
	retq
	.cfi_endproc

	.section	__TEXT,__cstring,cstring_literals
L_.str:                                 ## @.str
	.asciz	"bits %d, bitsp %d, bitsq %d\n"


.subsections_via_symbols

execute it

$ gcc a.c
$ ./a.out
bits 1024, bitsp 512, bitsq 512

conclusion

I have found nothing vulnerable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment