[ferrlabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
rsa	dev-dependencies	minor	0.9 → 0.10

---

Marvin Attack: potential key recovery through timing sidechannels

CVE-2023-49092 / GHSA-4grx-2x9w-596c / GHSA-c38w-74pg-36hr / RUSTSEC-2023-0071

More information

Details

Impact

Due to a non-constant-time implementation, information about the private key is leaked through timing information which is observable over the network. An attacker may be able to use that information to recover the key.

Patches

The rsa v0.10 series includes a migration to crypto-bigint and constant-time mitigations recommended in draft-irtf-cfrg-rsa-guidance. Upgrading to this release should resolve all known constant-time issues.

References

This vulnerability was discovered as part of the "Marvin Attack", which revealed several implementations of RSA including OpenSSL had not properly mitigated timing sidechannel attacks.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://crates.io/crates/rsa
• https://rustsec.org/advisories/RUSTSEC-2023-0071.html
• https://github.com/RustCrypto/RSA/issues/626
• https://github.com/RustCrypto/RSA/issues/19#issuecomment-1822995643
• https://people.redhat.com/~hkario/marvin/
• https://github.com/RustCrypto/RSA/pull/394
• https://github.com/RustCrypto/RSA/pull/680
• https://github.com/RustCrypto/RSA/pull/702

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

RustCrypto/RSA (rsa)

v0.10.0

Compare Source

Security

• Replace num-bigint-dig with crypto-bigint for constant-time modular exponentiation (#​394)
• Redact private-key components from Debug output (#​480)
• Harden private-key operations following draft-irtf-cfrg-rsa-guidance (#​710, #​715, #​739,
  #​751, #​752, #​755, #​756, #​758, #​770, #​771, #​773)
• Zeroize stored secret-prime Montgomery parameters in PrecomputedValues (#​716)
• Implement PKCS#1 v1.5 implicit rejection: return deterministic synthetic plaintext on invalid
  padding instead of exposing a padding error and with it a sidechannel (#​726, #​729, #​749)

Added

• PKCS#8/SPKI decoding for PSS keys, including id-RSASSA-PSS algorithm identifiers (#​424)
• pss::VerifyingKey::salt_len and opt-in automatic salt-length detection via
  new_with_auto_salt_len (#​448, #​546)
• Wycheproof test coverage for PKCS#1 v1.5, PSS, and OAEP (#​477, #​740)
• PublicKeyParts::n_bytes and e_bytes serialization helpers (#​519)
• Multipart signing trait implementations for PKCS#1 v1.5 and PSS (#​525)
• Clone and core::error::Error implementations for Error (#​530, #​694)
• PrivateKey::as_public_key accessor (#​592)
• Algorithm-specific inherent methods on PrivateKey and PublicKey for OAEP encryption/decryption
  and PKCS#1 v1.5/PSS signing/verification, including prehash and explicit-RNG variants (#​638)
• PrivateKey::from_components_with_large_exponent, gated on hazmat (#​648)
• Constant-time validation harness using cargo checkct/BINSEC (#​732, #​733, #​749, #​756,
  #​771, #​773)
• PrivateKey::from_components_with_wide_primes for unbalanced two-prime keys, which ordinary
  constructors now reject (#​755)
• TryFrom<BitStringRef<'_>> for PKCS#1 v1.5 and PSS signatures (#​764)
• crypto_common::Generate implementation and Generate re-export for generating 3072-bit keys
  with public exponent 65537 (#​780)

Changed

• Replace BigUint in the public API with BoxedUint; return NonZero<BoxedUint> for the modulus
  and Odd<BoxedUint> for prime factors (#​394, #​735)
• Use crypto-primes for prime generation (#​394)
• Use DER-based key encodings and hex-or-binary serde representations via serdect; extend serde
  support to OAEP, PKCS#1 v1.5, and PSS wrapper types (#​420)
• Accept arbitrary byte strings as OAEP labels (#​467)
• Gate PKCS#1/PKCS#8/SPKI support on the default-enabled encoding feature; std no longer
  implicitly enables encoding dependencies (#​537, #​543)
• Enforce a 1024-bit minimum for key generation and default public-key construction/decoding; add
  PublicKey::new_with_size_limits and hazmat-gated unchecked key generation (#​576, #​760)
• Bump pkcs1 to v0.8; pkcs8 to v0.11; spki to v0.8; serdect to v0.4 (#​584, #​684, #​688,
  #​766)
• Make Oaep and Pss generic over their digest types instead of using DynDigest (#​593)
• Bump rand_core to v0.10, crypto-common to v0.2, digest to v0.11, and signature to v3
  (#​650, #​671, #​693)
• Remove a redundant allocation during OAEP decryption (#​659)
• Improve encryption and verification performance by bounding exponentiation to the public
  exponent's bit length (#​662)
• Bump crypto-bigint to v0.7.10 and crypto-primes to v0.7 (#​673, #​766)
• Raise the default maximum public-key modulus size to 8192 bits (#​681)
• Bump sha1 and sha2 to v0.11 (#​683)
• Store PKCS#1 v1.5 and PSS signatures as byte strings, preserving their encoded width (#​722,
  #​723)
• MSRV 1.87; Rust 2024 edition (#​731, #​757)
• Enable getrandom by default and use the system RNG for blinding in default decryption and
  signing paths (#​739, #​758)
• Limit signature decoding to 1024 bytes by default; add Signature::from_bytes_with_max_len for
  explicit limits (#​767)
• Require the opt-in pkcs1v15 feature for PKCS#1 v1.5 encryption and signatures (#​778)
• Accept fallible RNGs through TryCryptoRng and propagate RNG failures as errors (#​779)
• Rename RsaPrivateKey and RsaPublicKey to PrivateKey and PublicKey, retaining the old names
  as deprecated aliases (#​781)

Deprecated

• pss::BlindedSigningKey in favor of pss::SigningKey, which now applies blinding by
  default (#​758)
• PublicKey::new_with_max_size in favor of PublicKey::new_with_size_limits (#​760)

Removed

• nightly and u64_digit features associated with num-bigint-dig (#​394)
• Deprecated Pkcs1v15Sign::new_raw and pkcs1v15 *_with_prefix constructors (#​524)
• Separate pem feature; PEM support is included with encoding (#​537)
• Optional sha2 feature; SHA-2 support is now always enabled (#​749)

Fixed

• Honor explicit larger-key construction limits during cryptographic operations, including OAEP
  decryption (#​441, #​595)
• PKCS#1 v1.5 SigningKey::from and VerifyingKey::from now use the digest prefix consistently
  with new (#​472, #​498)
• Check the modulus's actual bit length instead of its storage precision when enforcing size limits
  (#​529)
• Retry zero blinding factors instead of replacing them with one (#​653)
• Reject private-key factors less than or equal to one, even or repeated factors, and private
  exponents greater than or equal to the modulus (#​655, #​738, #​772, #​774)
• Reject PSS salt lengths that cannot be represented by the AlgorithmIdentifier encoder instead of
  truncating them (#​704)
• Apply RFC 8017 encoded-message width rules for PSS, including moduli whose bit length is congruent
  to 1 modulo 8 (#​725)
• Return verification errors instead of panicking for undersized PSS encoded messages and
  overflowing salt lengths (#​769)
• Propagate CRT precomputation errors from private-key constructors (#​782)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.