Reject point at infinity in EC_KEY_set_public_key#3101
Conversation
Add an explicit check in EC_KEY_set_public_key to reject the point at infinity. The point at infinity is not a valid public key and accepting it enables universal ECDSA signature forgery. This matches the hardening added in BoringSSL commit a135fe1fad70e4f87b38b0adebd44d93da7eb173. Parsing (EC_POINT_oct2point) continues to accept the infinity encoding for OpenSSL compatibility, as added in de33f5e, but it can no longer be installed as a public key on an EC_KEY.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3101 +/- ##
==========================================
+ Coverage 78.19% 78.38% +0.19%
==========================================
Files 689 689
Lines 122037 122049 +12
Branches 17026 17035 +9
==========================================
+ Hits 95430 95674 +244
+ Misses 25701 25469 -232
Partials 906 906 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
There might also be a way to populate an EC_KEY with a point at infinity via o2i_ECPublicKey?
|
You should probably also update the API documentation too like BoringSSL did: |
Thank you, @justsmth, added a check there too and a corresponding test. |
Thank you, @alexw91 , added. |
Harden o2i_ECPublicKey to reject the point at infinity after decoding. Unlike EC_KEY_oct2key, o2i_ECPublicKey writes directly to the EC_KEY's pub_key field without going through EC_KEY_set_public_key, so it needs its own check. Update the EC_KEY_set_public_key documentation to note that the point at infinity is rejected, matching BoringSSL commit a135fe1fad70e4f87b38b0adebd44d93da7eb173.
b90b9f1 to
d541639
Compare
Issues:
Addresses P398529487
Description of changes:
Add an explicit check in EC_KEY_set_public_key to reject the point at infinity. The point at infinity is not a valid public key.
This matches the hardening added in BoringSSL google/boringssl@a135fe1.
Call-outs:
Parsing (EC_POINT_oct2point) continues to accept the infinity encoding for OpenSSL compatibility, as added in
de33f5e, but it can no longer be installed as a public key on an EC_KEY.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.