Hacker News Reader

Comment by jlgaddis | Hacker News Reader

Exhibit A: CVE-2013-2228.

As described inthe relevant entry [0] on Debian's Security Tracker:

> SaltStack RSA Key Generation allows remote users to decrypt communications

The fix [1]:

  - gen = RSA.gen_key(keysize, 1, callback=lambda x, y, z: None)
  + gen = RSA.gen_key(keysize, 65537, callback=lambda x, y, z: None)

---

[0]: https://security-tracker.debian.org/tracker/CVE-2013-2228

[1]: https://github.com/saltstack/salt/commit/e8ce66cf688b43aeb3e...

View on HN

The second parameter in the gen_key function is the RSA public exponent. I believe this means the ciphertext will be the same as the padded plaintext.

Here is the documentation from the RSA.gen_key() function.

    def gen_key(bits, e, callback=keygen_callback):
        # type: (int, int, Callable) -> RSA
        """
        Generate an RSA key pair.

        :param bits: Key length, in bits.

        :param e: The RSA public exponent.

        :param callback: A Python callable object that is invoked
                         during key generation; its usual purpose is to
                         provide visual feedback. The default callback is
                         keygen_callback.

        :return: M2Crypto.RSA.RSA object.
        """

https://gitlab.com/m2crypto/m2crypto/-/blob/master/M2Crypto/...

This is reminiscent of

    int getRandomNumber()
    {
        return 4;  // chosen by fair dice roll.
                   // guaranteed to be random.
    }

Jesus that's some rookie stuff right there

They also built their own low-level network protocol based on 0mq. Back when I tried it, it had constant keepalive issues behind NAT and would randomly lose messages (that was in 2014, probably better now).

It wasn't any better as of last year, and its constant connectivity issues were part of the reason I abandoned it.

This is rookie stuff, but it’s a recurring security issue where crypto libraries have APIs littered with footguns. The “lambda x, y, z: None” just strikes me as cargo culting copy paste code - I’m willing to bet there is other software with the same exploit as they all copied the same answer on StackOverflow

Reply on news.ycombinator.com