fix: limit default PBES2 alg's computational expense

Also adds an option to opt-in to higher computation expense.
panva · Sep 1, 2022 · 4e7121a · 4e7121a
1 parent 51e0d8b
commit 4e7121a
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 1 deletion.
diff --git a/docs/README.md b/docs/README.md
@@ -1472,6 +1472,10 @@ operation.
   - `algorithms`: `string[]` Array of Algorithms to accept, when the JWE does not use an
     Key Management algorithm from this list the decryption will fail. **Default:** 'undefined' -
     accepts all algorithms available on the keys
+  - `maxPBES2Count`: `number` (PBES2 Key Management Algorithms only) Maximum allowed "p2c" (PBES2
+    Count) Header Parameter value. The PBKDF2 iteration count defines the algorithm's computational
+    expense.
+    **Default:** '10000'
   - `complete`: `<boolean>` When true returns an object with the parsed headers, verified
     AAD, the content encryption key, the key that was used to unwrap or derive the content
     encryption key, and cleartext instead of only the cleartext.

diff --git a/lib/jwe/decrypt.js b/lib/jwe/decrypt.js
@@ -40,7 +40,7 @@ const combineHeader = (prot = {}, unprotected = {}, header = {}) => {
 /*
  * @public
  */
-const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], complete = false, algorithms } = {}) => {
+const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], complete = false, algorithms, maxPBES2Count = 10000 } = {}) => {
   key = getKey(key, true)
 
   if (algorithms !== undefined && (!Array.isArray(algorithms) || algorithms.some(s => typeof s !== 'string' || !s))) {
@@ -124,6 +124,12 @@ const jweDecrypt = (skipValidateHeaders, serialization, jwe, key, { crit = [], c
 
     check(key, ...(alg === 'dir' ? ['decrypt', enc] : ['keyManagementDecrypt', alg]))
 
+    if (alg.startsWith('PBES2')) {
+      if (opts && opts.p2c > maxPBES2Count) {
+        throw new errors.JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds')
+      }
+    }
+
     try {
       if (alg === 'dir') {
         cek = JWK.asKey(key, { alg: enc, use: 'enc' })

diff --git a/test/jwe/sanity.test.js b/test/jwe/sanity.test.js
@@ -589,3 +589,13 @@ test('"enc" value must be supported error (when no alg was specified)', t => {
     JWE.encrypt('foo', k, { enc: 'foo' })
   }, { instanceOf: errors.JOSENotSupported, message: 'unsupported encrypt alg: foo' })
 })
+
+if (!('electron' in process.versions)) {
+  test('decrypt PBES2 p2c limit', t => {
+    const k = generateSync('oct', 256)
+    const jwe = JWE.encrypt('foo', k, { alg: 'PBES2-HS256+A128KW' })
+    t.throws(() => {
+      JWE.decrypt(jwe, k, { maxPBES2Count: 1000 })
+    }, { instanceOf: errors.JWEInvalid, message: 'JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds' })
+  })
+}
diff --git a/types/index.d.ts b/types/index.d.ts
@@ -406,6 +406,7 @@ export namespace JWE {
     complete?: komplet;
     crit?: string[];
     algorithms?: string[];
+    maxPBES2Count?: number;
   }
 
   interface completeDecrypt {