| # OpenSSL Advisory: March 15th, 2022 |
| |
| OpenSSL have published a [security advisory](https://openssl-library.org/news/secadv/20220315.txt). Here's how it affects BoringSSL: |
| |
| CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL |
| ----|---------|-----------------------|--------------------- |
| CVE-2022-0778 | Infinite loop in `BN_mod_sqrt`() reachable when parsing certificates | High | Mostly unaffected. See discussion below. |
| |
| [Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity |
| |
| ## CVE-2022-0778 |
| |
| BoringSSL shares the underlying bug in `BN_mod_sqrt` as OpenSSL, but it is mostly unaffected by the DoS vulnerability. In particular, this bug is *not* reachable in BoringSSL from certificate and other ASN.1 elliptic curve parsing code. Impact in BoringSSL is limited to: |
| |
| * Callers of `EC_GROUP_new_curve_GFp` that take untrusted curve parameters |
| * Callers of `BN_mod_sqrt` that take untrusted moduli |
| |
| `BN_mod_sqrt` implements the [Tonelli–Shanks algorithm](https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm), which requires a prime modulus. It was written such that, given a composite modulus, it would sometimes loop forever. |
| |
| Modular square roots are used when decoding compressed coordinates in elliptic curve cryptography (ECC). Like its multiplicative-group counterpart, ECC acts over pre-agreed curves (i.e. think of the curve as part of the selected algorithm). This ensures each party in a protocol can reason about preconditions, security levels, etc. However, the ECC encoding was initially highly-general and X9.62 includes a specifiedCurve form that spells out a nearly arbitrary curve formula. [RFC 5480](https://www.rfc-editor.org/rfc/rfc5480.html) forbids this form: |
| |
| > specifiedCurve, which is of type SpecifiedECDomain type (defined |
| > in [X9.62]), allows all of the elliptic curve domain parameters |
| > to be explicitly specified. This choice MUST NOT be used. See |
| > Section 5, "ASN.1 Considerations". |
| |
| OpenSSL supports the specifiedCurve form and allows it to specify unrecognized curves. This allows attackers to control curve parameters, and thus to break `BN_mod_sqrt` preconditions. BoringSSL does not allow this. We do not support the specifiedCurve form in public keys. While we do support it in private keys, we still [only construct known curves](https://boringssl.googlesource.com/boringssl/+/81502beeddc5f116d44d0898c6c4a33057198db8/crypto/ec_extra/ec_asn1.c#373). |
| |
| The fix to `BN_mod_sqrt` has been imported as of [this change](https://boringssl-review.googlesource.com/c/boringssl/+/51925). |
