mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-08 19:42:05 +02:00
Tobias Frauenschläger
fd13b11755
wc_DhSetKey_ex loads DH parameters as untrusted and validates that the modulus is prime, but it passed no RNG, so the check fell back to a Miller-Rabin test using the fixed small-prime bases 2 through 19. That test is defeatable: a composite crafted as a strong pseudoprime to those known bases passes as prime, letting an attacker supply a composite modulus with a smooth factorization for small-subgroup recovery of the private exponent and shared secret. When no RNG is supplied on the untrusted path, create a temporary RNG so mp_prime_is_prime_ex runs with random witnesses, which such crafted composites cannot reliably pass. Named FFDHE primes still short-circuit the check, and builds without an RNG keep the deterministic test. Fixes F-6776.
The wolfSSL manual is available at: http://www.wolfssl.com/documentation/wolfSSL-Manual.pdf The wolfSSL API guide is available at: https://www.wolfssl.com/doxygen/wolfssl_API.html The wolfCrypt API guide is available at: https://www.wolfssl.com/doxygen/wolfcrypt_API.html