Verified results for the replacement direct digest-alias reproducer: identical script fails on affected Noble libcrypto with and without FIPS, and passes the OpenSSL 3.5.5 control. This supersedes the prior CMS-only evidence for reproducing the underlying lookup bug.
** Attachment added: "digest-alias-validation.txt" https://bugs.launchpad.net/bugs/2172322/+attachment/6013053/+files/digest-alias-validation.txt ** Summary changed: - Noble OpenSSL: missing digest-alias lookup fix causes incorrect CMS OAEP parameters + Noble OpenSSL: digest aliases fail before an explicit fetch ** Description changed: - Ubuntu 24.04 LTS (Noble), source package `openssl`; affected `openssl` / - `libssl3t64` version: `3.0.13-0ubuntu3.16`. + Ubuntu 24.04 LTS (Noble), `openssl` / `libssl3t64` `3.0.13-0ubuntu3.16`. - In libcrypto's `crypto/evp/names.c`, `evp_get_digestbyname_ex()` fails - to resolve provider aliases such as `SHA2-256` and `SHA2-384` when they - are absent from the application context's name map. The legacy OAEP/MGF1 - digest getters consequently return success with NULL digest pointers. + In a fresh process, `EVP_get_digestbyname("SHA2-256")` and + `EVP_get_digestbyname("SHA2-384")` return NULL. Both digests are + available: explicit `EVP_MD_fetch()` calls succeed, after which the + legacy lookups resolve correctly. Expected: both aliases resolve before + an explicit fetch. - This causes CMS to encode SHA1 defaults even though the content key was - wrapped using the requested SHA256 or SHA384. Encryption reports - success, but decryption fails with `bad decrypt`. Correcting only the - encoded parameters restores decryption. CMS-based SCEP clients, - including certmonger using RSA-OAEP, can be affected. + This reproduces **with and without FIPS**. Run the attached direct + reproducer: - Expected: digest aliases resolve correctly and CMS parameters match the - hashes used for encryption. + python3 -I -S reproduce-digest-alias.py - The attached standalone OpenSSL reproducer tests AES128/AES256 with - SHA1/SHA256/SHA384: two SHA1 cases pass; four SHA256/SHA384 cases fail. - This CMS reproduction uses Ubuntu's FIPS provider; environment details - are attached. The underlying lookup defect is generic, but this report - does not establish non-FIPS CMS failure. + Exit 1 means reproduced; 0 means not reproduced; 2 means inconclusive. + The identical script detects the defect using byte-identical Noble + libcrypto binaries in native FIPS mode and a non-FIPS container. An + OpenSSL 3.5.5 control resolves both aliases immediately. See `digest- + alias-validation.txt`. - Please backport the existing fix to Noble: + Please disregard `reproduce-native-oaep-roundtrip.sh` as the primary + reproducer. That script tested a downstream CMS symptom: incorrect + OAEP/MGF1 digest parameters with the FIPS provider. Default-provider CMS + operations can mask the underlying lookup defect. The original + `validation-evidence.txt` remains historical evidence of that downstream + failure, which can affect CMS-based clients such as certmonger. - - [OpenSSL issue #19338](https://github.com/openssl/openssl/issues/19338): the underlying provider digest-alias lookup defect. - - [Commit 1dc48db3](https://github.com/openssl/openssl/commit/1dc48db3c76b7d36be34c3b707d084d364f41c83): fetch the unresolved algorithm and retry lookup; included in OpenSSL 3.0.15. - - [Debian applied this fix](https://lists.debian.org/debian-release/2024/11/msg00238.html) in `3.0.15-1~deb12u1` in November 2024. The inspected Noble source lacks it. + Please backport [OpenSSL fix + 1dc48db3](https://github.com/openssl/openssl/commit/1dc48db3c76b7d36be34c3b707d084d364f41c83) + for [issue #19338](https://github.com/openssl/openssl/issues/19338). It + is included in OpenSSL 3.0.15; [Debian applied + it](https://lists.debian.org/debian-release/2024/11/msg00238.html) in + `3.0.15-1~deb12u1`. The inspected Noble source lacks it. - Attachments: `reproduce-native-oaep-roundtrip.sh`, `validation- - evidence.txt`. + Primary attachments: `reproduce-digest-alias.py`, `digest-alias- + validation.txt`. ** Attachment removed: "reproduce-native-oaep-roundtrip.sh" https://bugs.launchpad.net/bugs/2172322/+attachment/6013043/+files/reproduce-native-oaep-roundtrip.sh -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172322 Title: Noble OpenSSL: digest aliases fail before an explicit fetch To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2172322/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
