| # OpenSSL Advisory: August 1st, 2023 |
| |
| OpenSSL published [new releases](https://mta.openssl.org/pipermail/openssl-announce/2023-August/000268.html) covering security advisories from [July 19th](https://www.openssl.org/news/secadv/20230719.txt) and [July 31st](https://www.openssl.org/news/secadv/20230731.txt). Here’s how they affect BoringSSL: |
| |
| CVE | Summary | [Severity] in OpenSSL | Impact to BoringSSL |
| ----|---------|-----------------------|--------------------- |
| CVE-2023-3446 | Excessive time spent checking DH keys and parameters | Low | See below |
| CVE-2023-3817 | Excessive time spent checking DH q parameter value | Low | See below |
| |
| [Severity]: https://openssl-library.org/policies/general/security-policy/index.html#issue-severity |
| |
| ## CVE-2023-3446 and CVE-2023-3817 |
| |
| Defining a cryptographic primitive involves picking “domain parameters”, such as ECC curves or, in the legacy Diffie-Hellman construction, integers p, q, and g that describe a multiplicative group. |
| |
| Domain parameters are not part of keys. They are part of the algorithm itself and should be fixed, trusted values. However, whereas ECC converged on a small set of named curves (e.g. P-256), legacy Diffie-Hellman parameters vary wildly. As a result, OpenSSL’s and BoringSSL’s Diffie-Hellman APIs must allow arbitrary, caller-supplied domain parameters. |
| |
| If the caller incorrectly supplies untrusted domain parameters, cryptographic properties of the algorithm may no longer hold. They additionally become an attack surface for further security issues. These advisories cover denial-of-service risks in such callers. |
| |
| The new OpenSSL releases enforce bounds on domain parameters in `DH_check`. BoringSSL applied an analogous change on [August 14th](https://boringssl.googlesource.com/boringssl/+/d85444e741b73a77fe4359cd3db189482d4f4806). Additionally: |
| |
| * Although OpenSSL’s advisory only discusses `DH_check`, large groups can impact other functions such as `DH_generate_key` and `DH_check_pub_key`. We bound all functions. |
| * OpenSSL supports a private key length parameter (`DH_set_length`). Large values can cause `DH_generate_key` to use excessive CPU. We mitigated this on [August 15th](https://boringssl.googlesource.com/boringssl/+/cb583e783500d92bbda9a850e43cd94df0b2d5e1). |
| |
| We have reported these two additional cases to OpenSSL. |
| |
| These issues do not impact our TLS implementation. Although the TLS 1.2 DHE construction did not correctly handle domain parameters, we removed DHE ciphers in [2017](https://boringssl.googlesource.com/boringssl/+/7e06de5d2d1b53c57c0c81e8d6ba4122b64cf626) for [related reasons](https://groups.google.com/a/chromium.org/g/blink-dev/c/AAdv838-koo/m/bJv17voIBAAJ). They additionally do not affect callers that correctly use Diffie-Hellman with trusted domain parameters. |
| |
| As only incorrect uses are impacted, BoringSSL considers these changes to be a hardening measure, rather than a security fix. In particular, these checks do not ensure the group is suitable for use with Diffie-Hellman—they only enforce a DoS bound. Ultimately, callers of legacy Diffie-Hellman are responsible for selecting valid domain parameters. Callers are recommended to migrate to modern primitives, such as X25519 or ECDH with P-256. |
