)]}'
{
  "commit": "68c29a24ee6c9c70ecce56766ca70b115aad768f",
  "tree": "4e636fb757e89fc8508db40a8fd7380d8b64a914",
  "parents": [
    "de6ba216656b819d4d8de7602006561f82a8c669"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Tue May 21 13:56:34 2024 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Tue May 21 19:16:55 2024 +0000"
  },
  "message": "Check DSA size limits in a couple more places\n\nThis change was prompted by CVE-2024-4603, but is *not* part of it.\nBoringSSL is not affected by CVE-2024-4603.\n\nWhen applications use DSA they are expected to use known-valid domain\nparameters (as required by FIPS 186-4, section 4.3). If the application\ninstead allows the attacker to supply domain parameters, DSA is no\nlonger cryptographically sound, and algorithms that were otherwise\ncorrect now become DoS attack surfaces.\n\nAlas, incorrect uses of DSA, like Diffie-Hellman (see CVE-2023-3446 and\nCVE-2023-3817) are rampant, so it is useful to bound our operations, so\nwe at least can say something coherent about DoS in this scenario, even\nthough we cannot avoid the application being cryptographically unsound.\nTo that end, we already check DSA sizes before using the key, however,\nwe missed a couple of operations:\n\n- DSA_generate_parameters_ex\n- DSA_generate_key\n\nThe CL adds those too. I would not expect either to have any security\nimpact as it\u0027s quite unlikely for an application to allow attacker\ncontrol of the inputs to either function. Still, we ought to check for\ncompleteness\u0027 sake. There\u0027s no sense in generating parameters or a key\nthat we know we\u0027ll reject.\n\nUltimately, the problem here is that DSA was a badly-designed primitive.\nwith a continuum of domain parameters. Experience has shown that such\nsystems are confusing and applications will often incorrectly treat\ndomain parameters as part of the key. Modern primitives use a small set\nof discrete, named parameter sets, which is far easier to get right. For\nthis reason, we consider DSA a deprecated, legacy algorithm.\n\nChange-Id: Ib3b5dece32bcb0ac9a795f8222c1c530d9dd91a0\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/68707\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a35b3849e483d3fb6d5bb2293ac6196f824e932f",
      "old_mode": 33188,
      "old_path": "crypto/dsa/dsa.c",
      "new_id": "b2eda204ed7336610290bc52a9c4022787281361",
      "new_mode": 33188,
      "new_path": "crypto/dsa/dsa.c"
    },
    {
      "type": "modify",
      "old_id": "1caf4ae6d7f0ea2d1c9f45c7ca9b508594bf5254",
      "old_mode": 33188,
      "old_path": "crypto/dsa/dsa_asn1.c",
      "new_id": "8ec55dd404c4c27b74435b96bf6d3b023ed8742d",
      "new_mode": 33188,
      "new_path": "crypto/dsa/dsa_asn1.c"
    },
    {
      "type": "modify",
      "old_id": "3b83e18471e99b98d3896abf2fdd624443ffd899",
      "old_mode": 33188,
      "old_path": "crypto/dsa/dsa_test.cc",
      "new_id": "f90c0097503a452a12ac4837d314883c83de4b46",
      "new_mode": 33188,
      "new_path": "crypto/dsa/dsa_test.cc"
    },
    {
      "type": "modify",
      "old_id": "61cf9a65bd17833aa3d329d08173e5652e93f9ca",
      "old_mode": 33188,
      "old_path": "crypto/dsa/internal.h",
      "new_id": "9cceeb121435f65149c0e04d4b54c9750ec117a0",
      "new_mode": 33188,
      "new_path": "crypto/dsa/internal.h"
    }
  ]
}