Mbedtls_pk_verify error
|
christian tavares
I developed a http_client app and that app receives a signature (BASE64), that signature is made with a hash(sha256) of the string data and the private key. At my app, I catch my
public key and call "mbedtls_pk_parse_public_key" and returns 0. In order to verify I call "mbedtls_pk_can_do( &pk, MBEDTLS_PK_RSA )" and "mbedtls_rsa_check_pubkey" and that's functions return 0.
After I decode the server_signature using "mbedtls_base64_decode" and return 0.
But, when I call the verification function "mbedtls_pk_verify" returns MBEDTLS_ERR_RSA_VERIFY_FAILED, don't understand the reason.
I already tested the same data using OpenSSL and the verification returns true. I tested the verification on the server side and returns true too.
Here https://github.com/chtavares592/verify_signature I
developed my simple example. I put the zephyr's app, the server and the keys. I don't know the reason for this problem if somebody can help I will be grateful. Thanks
|
|||
|
|
|||
|
I’m not sure exactly what is wrong, but I can spot numerous buffer overflows just by looking through the code. For example, in verify_signature, you’re calling:
snprintk(b1, sizeof(1), “%c”, msg[i]);
To start with, I’m not sure why you’re using snprintk of a single character, when you can just compare the character directly. But, sizeof(1) will be ‘4’ on most of our platforms, much more than the single character in the buffer.
I would guess initially that this is the problem with the code. In general, I wouldn’t expect this code to be making any calls to functions like ‘snprintk’, ‘strmp’, or the likes.
David
From: <devel@...> on behalf of christian tavares <christiantavarest@...>
I developed a http_client app and that app receives a signature (BASE64), that signature is made with a hash(sha256) of the string data and the private key. At my app, I catch my public key and call "mbedtls_pk_parse_public_key" and returns 0. In order to verify I call "mbedtls_pk_can_do( &pk, MBEDTLS_PK_RSA )" and "mbedtls_rsa_check_pubkey" and that's functions return 0. After I decode the server_signature using "mbedtls_base64_decode" and return 0. But, when I call the verification function "mbedtls_pk_verify" returns MBEDTLS_ERR_RSA_VERIFY_FAILED, don't understand the reason.
I already tested the same data using OpenSSL and the verification returns true. I tested the verification on the server side and returns true too. Here https://github.com/chtavares592/verify_signature I developed my simple example. I put the zephyr's app, the server and the keys. I don't know the reason for this problem if somebody can help I will be grateful. Thanks
|
|||
|
|
|||
|
christian tavares
Thanks for you answer me. I followed your tips and corrected that problems and I resolved to simplify the code removing the server side and letting just application working. But the problem doesn't resolve yet If you could see again o code modified I'll be grateful to help me. Thanks again.
https://github.com/chtavares592/verify_signature/blob/master/verify_signature/src/main.c |
|||
|
|
|||
|
There are still buffer/variable overflow problems, so I would make sure those are fixed before trying to figure out why else it might not be working. For example:
char buffer[2]; ... snprintk(buffer, SHA256_SIZE, "%02x", rsp_hash[i]); in this case, the buffer is 2 characters, yet you are passing a much larger value as the buffer's size. In this case the "%02x" will add two hex characters, and a terminating null, which will overflow the 2 character buffer, overwriting something else that is on the stack. There are other things like using memcmp to compare a single character, instead of memcmp(&msg[i], "U", sizeof(msg[i])), just use (msg[i] == 'U'). Beyond that, you'll probably have to start stepping through the code with a debugger to find out what is happening. But, I would work on the overflows and such first, since those can cause very confusing behavior. David From: Zephyr Devel <devel@...> on behalf of christian tavares <christiantavarest@...> Date: Monday, June 11, 2018 at 11:04 AM To: Zephyr Devel <devel@...> Subject: Re: [Zephyr-devel] Mbedtls_pk_verify error Thanks for you answer me. I followed your tips and corrected that problems and I resolved to simplify the code removing the server side and letting just application working. But the problem doesn't resolve yet If you could see again o code modified I'll be grateful to help me. Thanks again. https://github.com/chtavares592/verify_signature/blob/master/verify_signature/src/main.c |
|||
|
|
|||
