Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

remove unnecessarily err checks #948

Merged
merged 1 commit into from
Jun 21, 2023
Merged

remove unnecessarily err checks #948

merged 1 commit into from
Jun 21, 2023

Conversation

shogo82148
Copy link
Contributor

godoc says hash.Hash.Write never returns an error: https://pkg.go.dev/hash#Hash

Write (via the embedded io.Writer interface) adds more data to the running hash.
It never returns an error.

So, we don't need to check errors of Write and panics in Hmac.ComputeAuthTag.

@codecov
Copy link

codecov bot commented Jun 20, 2023 •
edited
Loading

Codecov Report

❗ No coverage uploaded for pull request base (develop/v2@2fa2a3b). Click here to learn what that means.
The diff coverage is n/a.

@@              Coverage Diff              @@
##             develop/v2     #948   +/-   ##
=============================================
  Coverage              ?   71.67%           
=============================================
  Files                 ?       93           
  Lines                 ?    13574           
  Branches              ?        0           
=============================================
  Hits                  ?     9729           
  Misses                ?     3033           
  Partials              ?      812

@lestrrat
Copy link
Collaborator

lestrrat commented Jun 20, 2023 •
edited
Loading

I understand the removal of hash.Write() error check. I'm okay with that part.

But I'm uncomfortable with the removal of the defer code, because the comment says they have to do with Open and Seal potentially panic'ing (TBH while I remember encountering those panics, I don't remember the details of why they happened). To me, they seemed unrelated to the hash.Write fix.

So, my initial thinking is that at least they shouldn't be included in the same PR?
Also, because at least my initial code and reasoning for adding those defers were for aead.Open and aead.Seal, can you please clarify why they are not necessary inside your commit message. You only talk about hash.Write, but it's the cause-effect relationship is not immediately clear

@shogo82148
remove unnecessarily err checks
57664d0 
godoc says hash.Hash.Write never returns an error: https://pkg.go.dev/hash#Hash

> Write (via the embedded io.Writer interface) adds more data to the running hash.
> It never returns an error.

So, we don't need to check errors of Write in Hmac.ComputeAuthTag.
@shogo82148 shogo82148 force-pushed the remove-unnecessarily-defer branch from 61708f1 to 57664d0 Compare June 21, 2023 05:14
@shogo82148 shogo82148 changed the title remove unnecessarily defer remove unnecessarily err checks Jun 21, 2023
@shogo82148
Copy link
Contributor Author

OK, I reverted the defer code.

@lestrrat
Copy link
Collaborator

Thank you!

@lestrrat lestrrat merged commit 82f7d5c into lestrrat-go:develop/v2 Jun 21, 2023
lestrrat added a commit that referenced this pull request Aug 10, 2023
@lestrrat @shogo82148
@dependabot @AdamKorcz @ItalyPaleAle
Merge for v2.0.12 (#965)
466c277 
* Merge pull request from GHSA-rm8v-mxj3-5rmq

### Summary

Decrypting AES-CBC encrypted JWE has Potential Padding Oracle Attack Vulnerability.

### Details

On [v2.0.10](https://github.com/lestrrat-go/jwx/releases/tag/v2.0.10), decrypting AES-CBC encrypted JWE may return an error "failed to generate plaintext from decrypted blocks: invalid padding":

https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213

```go
	plaintext, err := unpad(buf, c.blockCipher.BlockSize())
	if err != nil {
		return nil, fmt.Errorf(`failed to generate plaintext from decrypted blocks: %w`, err)
	}
```

Reporting padding error causes [Padding Oracle Attack](https://en.wikipedia.org/wiki/Padding_oracle_attack) Vulnerability.
RFC 7516 JSON Web Encryption (JWE) says that we MUST NOT do this.

> 11.5.  Timing Attacks
> To mitigate the attacks described in RFC 3218 [RFC3218], the
> recipient MUST NOT distinguish between format, padding, and length
> errors of encrypted keys.  It is strongly recommended, in the event
> of receiving an improperly formatted key, that the recipient
> substitute a randomly generated CEK and proceed to the next step, to
> mitigate timing attacks.

In addition, the time to remove padding depends on the length of the padding.
It may leak the length of the padding by Timing Attacks.

https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66

```go
func unpad(buf []byte, n int) ([]byte, error) {
	lbuf := len(buf)
	rem := lbuf % n

	// First, `buf` must be a multiple of `n`
	if rem != 0 {
		return nil, fmt.Errorf("input buffer must be multiple of block size %d", n)
	}

	// Find the last byte, which is the encoded padding
	// i.e. 0x1 == 1 byte worth of padding
	last := buf[lbuf-1]

	// This is the number of padding bytes that we expect
	expected := int(last)

	if expected == 0 || /* we _have_ to have padding here. therefore, 0x0 is not an option */
		expected > n || /* we also must make sure that we don't go over the block size (n) */
		expected > lbuf /* finally, it can't be more than the buffer itself. unlikely, but could happen */ {
		return nil, fmt.Errorf(`invalid padding byte at the end of buffer`)
	}

	// start i = 1 because we have already established that expected == int(last) where
	// last = buf[lbuf-1].
	//
	// we also don't check against lbuf-i in range, because we have established expected <= lbuf
	for i := 1; i < expected; i++ {
		if buf[lbuf-i] != last {
			return nil, fmt.Errorf(`invalid padding`)
		}
	}

	return buf[:lbuf-expected], nil
}
```

To mitigate Timing Attacks, it MUST be done in constant time.

### Impact

The authentication tag is verified, so it is not an immediate attack.

Co-authored-by: ICHINOSE Shogo <[email protected]>

* Update Changes

* Bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#938)

* Bump golang.org/x/crypto from 0.9.0 to 0.10.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.9.0 to 0.10.0.
- [Commits](golang/crypto@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* run gazelle-update-repos

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Bump github.com/lestrrat-go/jwx/v2 from 2.0.8 to 2.0.11 in /cmd/jwx (#942)

Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.8 to 2.0.11.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes)
- [Commits](v2.0.8...v2.0.11)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/lestrrat-go/jwx/v2 from 2.0.8 to 2.0.11 in /examples (#943)

Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.8 to 2.0.11.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes)
- [Commits](v2.0.8...v2.0.11)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/lestrrat-go/jwx/v2 in /bench/performance (#944)

Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.8 to 2.0.11.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes)
- [Commits](v2.0.8...v2.0.11)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* remove unnecessarily err checks (#948)

godoc says hash.Hash.Write never returns an error: https://pkg.go.dev/hash#Hash

> Write (via the embedded io.Writer interface) adds more data to the running hash.
> It never returns an error.

So, we don't need to check errors of Write in Hmac.ComputeAuthTag.

* Adam korcz fix 1 (#949)

* fix panic from empty seed

Signed-off-by: AdamKorcz <[email protected]>

* Add test case

---------

Signed-off-by: AdamKorcz <[email protected]>
Co-authored-by: AdamKorcz <[email protected]>

* add size check (#950)

Signed-off-by: AdamKorcz <[email protected]>

* Add test case to #952 (#953)

* Do not ignore custom encrypt and sign options in jwt package

Fixes #951

* Add test case

* Update Changes

---------

Co-authored-by: ItalyPaleAle <[email protected]>

* Bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#956)

* Bump golang.org/x/crypto from 0.10.0 to 0.11.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.10.0 to 0.11.0.
- [Commits](golang/crypto@v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Update bazel repos

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#963)

* Bump golang.org/x/crypto from 0.11.0 to 0.12.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.11.0 to 0.12.0.
- [Commits](golang/crypto@v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Run gazelle-update-repos

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Add documentation that explains #959 (#964)

* Add documentation that explains #959

* run genoptions

* Update Changes for v2.0.12

---------

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: AdamKorcz <[email protected]>
Co-authored-by: ICHINOSE Shogo <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: AdamKorcz <[email protected]>
Co-authored-by: AdamKorcz <[email protected]>
Co-authored-by: ItalyPaleAle <[email protected]>
lestrrat added a commit that referenced this pull request Sep 26, 2023
@lestrrat @shogo82148
@dependabot @AdamKorcz @ItalyPaleAle @github-actions
merge for v2.0.13 (#989)
be93b3f 
* Merge pull request from GHSA-rm8v-mxj3-5rmq

### Summary

Decrypting AES-CBC encrypted JWE has Potential Padding Oracle Attack Vulnerability.

### Details

On [v2.0.10](https://github.com/lestrrat-go/jwx/releases/tag/v2.0.10), decrypting AES-CBC encrypted JWE may return an error "failed to generate plaintext from decrypted blocks: invalid padding":

https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213

```go
	plaintext, err := unpad(buf, c.blockCipher.BlockSize())
	if err != nil {
		return nil, fmt.Errorf(`failed to generate plaintext from decrypted blocks: %w`, err)
	}
```

Reporting padding error causes [Padding Oracle Attack](https://en.wikipedia.org/wiki/Padding_oracle_attack) Vulnerability.
RFC 7516 JSON Web Encryption (JWE) says that we MUST NOT do this.

> 11.5.  Timing Attacks
> To mitigate the attacks described in RFC 3218 [RFC3218], the
> recipient MUST NOT distinguish between format, padding, and length
> errors of encrypted keys.  It is strongly recommended, in the event
> of receiving an improperly formatted key, that the recipient
> substitute a randomly generated CEK and proceed to the next step, to
> mitigate timing attacks.

In addition, the time to remove padding depends on the length of the padding.
It may leak the length of the padding by Timing Attacks.

https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66

```go
func unpad(buf []byte, n int) ([]byte, error) {
	lbuf := len(buf)
	rem := lbuf % n

	// First, `buf` must be a multiple of `n`
	if rem != 0 {
		return nil, fmt.Errorf("input buffer must be multiple of block size %d", n)
	}

	// Find the last byte, which is the encoded padding
	// i.e. 0x1 == 1 byte worth of padding
	last := buf[lbuf-1]

	// This is the number of padding bytes that we expect
	expected := int(last)

	if expected == 0 || /* we _have_ to have padding here. therefore, 0x0 is not an option */
		expected > n || /* we also must make sure that we don't go over the block size (n) */
		expected > lbuf /* finally, it can't be more than the buffer itself. unlikely, but could happen */ {
		return nil, fmt.Errorf(`invalid padding byte at the end of buffer`)
	}

	// start i = 1 because we have already established that expected == int(last) where
	// last = buf[lbuf-1].
	//
	// we also don't check against lbuf-i in range, because we have established expected <= lbuf
	for i := 1; i < expected; i++ {
		if buf[lbuf-i] != last {
			return nil, fmt.Errorf(`invalid padding`)
		}
	}

	return buf[:lbuf-expected], nil
}
```

To mitigate Timing Attacks, it MUST be done in constant time.

### Impact

The authentication tag is verified, so it is not an immediate attack.

Co-authored-by: ICHINOSE Shogo <[email protected]>

* Update Changes

* Bump golang.org/x/crypto from 0.9.0 to 0.10.0 (#938)

* Bump golang.org/x/crypto from 0.9.0 to 0.10.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.9.0 to 0.10.0.
- [Commits](golang/crypto@v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* run gazelle-update-repos

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Bump github.com/lestrrat-go/jwx/v2 from 2.0.8 to 2.0.11 in /cmd/jwx (#942)

Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.8 to 2.0.11.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes)
- [Commits](v2.0.8...v2.0.11)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/lestrrat-go/jwx/v2 from 2.0.8 to 2.0.11 in /examples (#943)

Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.8 to 2.0.11.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes)
- [Commits](v2.0.8...v2.0.11)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github.com/lestrrat-go/jwx/v2 in /bench/performance (#944)

Bumps [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) from 2.0.8 to 2.0.11.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes)
- [Commits](v2.0.8...v2.0.11)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* remove unnecessarily err checks (#948)

godoc says hash.Hash.Write never returns an error: https://pkg.go.dev/hash#Hash

> Write (via the embedded io.Writer interface) adds more data to the running hash.
> It never returns an error.

So, we don't need to check errors of Write in Hmac.ComputeAuthTag.

* Adam korcz fix 1 (#949)

* fix panic from empty seed

Signed-off-by: AdamKorcz <[email protected]>

* Add test case

---------

Signed-off-by: AdamKorcz <[email protected]>
Co-authored-by: AdamKorcz <[email protected]>

* add size check (#950)

Signed-off-by: AdamKorcz <[email protected]>

* Add test case to #952 (#953)

* Do not ignore custom encrypt and sign options in jwt package

Fixes #951

* Add test case

* Update Changes

---------

Co-authored-by: ItalyPaleAle <[email protected]>

* Bump golang.org/x/crypto from 0.10.0 to 0.11.0 (#956)

* Bump golang.org/x/crypto from 0.10.0 to 0.11.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.10.0 to 0.11.0.
- [Commits](golang/crypto@v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Update bazel repos

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#963)

* Bump golang.org/x/crypto from 0.11.0 to 0.12.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.11.0 to 0.12.0.
- [Commits](golang/crypto@v0.11.0...v0.12.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Run gazelle-update-repos

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Add documentation that explains #959 (#964)

* Add documentation that explains #959

* run genoptions

* Update Changes for v2.0.12

* Add example for using raw JWT (#967)

* Add example for using raw JWT

* typo

* autodoc updates (#968)

Co-authored-by: lestrrat <[email protected]>

* Update jwk iteration (#971)

* autodoc updates (#972)

Co-authored-by: lestrrat <[email protected]>

* Bump actions/checkout from 3 to 4 (#974)

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update HWK option documentation (#979)

* Update option documentation

* reinstance CacheOption

* Sample implementation of jwk.Equal (#977)

* Bump golang.org/x/crypto from 0.12.0 to 0.13.0 (#976)

* Bump golang.org/x/crypto from 0.12.0 to 0.13.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.12.0 to 0.13.0.
- [Commits](golang/crypto@v0.12.0...v0.13.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

* Run gazelle-update-repos & make tidy

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* Bump github.com/lestrrat-go/blackmagic from 1.0.1 to 1.0.2 (#983)

* Bump github.com/lestrrat-go/blackmagic from 1.0.1 to 1.0.2

Bumps [github.com/lestrrat-go/blackmagic](https://github.com/lestrrat-go/blackmagic) from 1.0.1 to 1.0.2.
- [Commits](lestrrat-go/blackmagic@v1.0.1...v1.0.2)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/blackmagic
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

* Run gazelle-update-repos

* Run make tidy

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Daisuke Maki <[email protected]>

* adapt to change in notation

* Upgrade golangci-lint to 1.54.2 (#986)

* Update Changes

---------

Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: AdamKorcz <[email protected]>
Co-authored-by: ICHINOSE Shogo <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: AdamKorcz <[email protected]>
Co-authored-by: AdamKorcz <[email protected]>
Co-authored-by: ItalyPaleAle <[email protected]>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: lestrrat <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@shogo82148 @lestrrat