- Replaced function that fixes man-in-the-middle attack

- Added message to indicate inclusion of man-in-the-middle attack (Reported by Larry Highsmith, Subreption LLC)
 - Released version 0.99-pre3

ChangeLog

@@ -1,6 +1,7 @@
 PolarSSL ChangeLog
 
-= Version 0.99-pre2 released on 2011-02-25
+= Version 0.99-pre3 released on 2011-02-28
+This release replaces version 0.99-pre2 which had possible copyright issues.
 Features
    * Parsing PEM private keys encrypted with DES and AES
      are now supported as well (Fixes ticket #5)
@@ -24,6 +25,11 @@ Bugfixes
      to negotiate anonymous connection (Fixes ticket #12,
 	 found by Boris Krasnovskiy)
 
+Security fixes
+   * Fixed a possible Man-in-the-Middle attack on the
+     Diffie Hellman key exchange (thanks to Larry Highsmith,
+	 Subreption LLC)
+
 = Version 0.99-pre1 released on 2011-01-30
 Features
 Note: Most of these features have been donated by Fox-IT

doxygen/input/doc_mainpage.h

@@ -4,7 +4,7 @@ l/**
  */
 
 /**
- * @mainpage PolarSSL v0.99-pre2 source code documentation
+ * @mainpage PolarSSL v0.99-pre3 source code documentation
  * 
  * This documentation describes the internal structure of PolarSSL.  It was
  * automatically generated from specially formatted comment blocks in

doxygen/polarssl.doxyfile

@@ -25,7 +25,7 @@ DOXYFILE_ENCODING      = UTF-8
 # The PROJECT_NAME tag is a single word (or a sequence of words surrounded
 # by quotes) that should identify the project.
 
-PROJECT_NAME           = "PolarSSL v0.99-pre2"
+PROJECT_NAME           = "PolarSSL v0.99-pre3"
 
 # The PROJECT_NUMBER tag can be used to enter a project or revision number.
 # This could be handy for archiving the generated documentation or

include/polarssl/version.h

@@ -39,16 +39,16 @@
  */
 #define POLARSSL_VERSION_MAJOR  0
 #define POLARSSL_VERSION_MINOR  99
-#define POLARSSL_VERSION_PATCH  2
+#define POLARSSL_VERSION_PATCH  3
 
 /**
  * The single version number has the following structure:
  *    MMNNPP00
  *    Major version | Minor version | Patch version
  */
-#define POLARSSL_VERSION_NUMBER         0x00630200
+#define POLARSSL_VERSION_NUMBER         0x00630300
-#define POLARSSL_VERSION_STRING         "0.99.2"
+#define POLARSSL_VERSION_STRING         "0.99.3"
-#define POLARSSL_VERSION_STRING_FULL    "PolarSSL 0.99.2"
+#define POLARSSL_VERSION_STRING_FULL    "PolarSSL 0.99.3"
 
 #if defined(POLARSSL_VERSION_C)
 

library/CMakeLists.txt

@@ -42,7 +42,7 @@ add_library(polarssl STATIC ${src})
 else(NOT USE_SHARED_POLARSSL_LIBRARY)
 
 ADD_LIBRARY(polarssl SHARED ${src})
-SET_TARGET_PROPERTIES(polarssl PROPERTIES VERSION 0.99.2 SOVERSION 0)
+SET_TARGET_PROPERTIES(polarssl PROPERTIES VERSION 0.99.3 SOVERSION 0)
 
 endif(NOT USE_SHARED_POLARSSL_LIBRARY)
 

library/dhm.c

@@ -63,34 +63,32 @@ static int dhm_read_bignum( mpi *X,
 }
 
 /*
- * Verify sanity of public value with regards to P
+ * Verify sanity of public parameter with regards to P
+ *
+ * Public parameter should be: 2 <= public_param <= P - 2
+ *
+ * For more information on the attack, see:
+ *  http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf
+ *  http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2643
  */
-static int dhm_verifypub( const mpi *P,  const mpi *pub_value )
+static int dhm_check_range( const mpi *public_param, const mpi *P )
 {
-    mpi X;
+    mpi L, U;
+    int ret = POLARSSL_ERR_DHM_BAD_INPUT_DATA;
 
-    mpi_init( &X, NULL );
+    mpi_init( &L, &U, NULL );
-    mpi_lset( &X, 1 );
+    mpi_lset( &L, 2 );
+    mpi_sub_int( &U, P, 2 );
 
-    /* Check G^Y or G^X is valid */
+    if( mpi_cmp_mpi( public_param, &L ) >= 0 &&
-    if( mpi_cmp_mpi( pub_value, &X ) <= 0 )
+        mpi_cmp_mpi( public_param, &U ) <= 0 )
     {
-        mpi_free( &X, NULL );
+        ret = 0;
-        return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
     }
 
-    /* Reset: x = P - 1 */
+    mpi_free( &L, &U, NULL );
-    mpi_sub_int( &X, P, 1 );
 
-    if( mpi_cmp_mpi( pub_value, &X ) >= 0 )
+    return( ret );
-    {
-        mpi_free( &X, NULL );
-        return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
-    }
-
-    mpi_free( &X, NULL );
-
-    return( 0 );
 }
 
 /*
@@ -109,6 +107,9 @@ int dhm_read_params( dhm_context *ctx,
         ( ret = dhm_read_bignum( &ctx->GY, p, end ) ) != 0 )
         return( ret );
 
+    if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
+        return( ret );
+
     ctx->len = mpi_size( &ctx->P );
 
     if( end - *p < 2 )
@@ -120,9 +121,6 @@ int dhm_read_params( dhm_context *ctx,
     if( end != *p + n )
         return( POLARSSL_ERR_DHM_BAD_INPUT_DATA );
 
-    if( ( ret = dhm_verifypub( &ctx->P, &ctx->GY ) ) != 0 )
-        return( ret );
-
     return( 0 );
 }
 
@@ -156,7 +154,7 @@ int dhm_make_params( dhm_context *ctx, int x_size,
     MPI_CHK( mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
                           &ctx->P , &ctx->RP ) );
 
-    if( ( ret = dhm_verifypub( &ctx->P, &ctx->GX ) ) != 0 )
+    if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
         return( ret );
 
     /*
@@ -235,8 +233,8 @@ int dhm_make_public( dhm_context *ctx, int x_size,
     MPI_CHK( mpi_exp_mod( &ctx->GX, &ctx->G, &ctx->X,
                           &ctx->P , &ctx->RP ) );
 
-    if( dhm_verifypub( &ctx->P, &ctx->GX ) != 0 )
+    if( ( ret = dhm_check_range( &ctx->GX, &ctx->P ) ) != 0 )
-        return( POLARSSL_ERR_DHM_MAKE_PUBLIC_FAILED );
+        return( ret );
 
     MPI_CHK( mpi_write_binary( &ctx->GX, output, olen ) );
 
@@ -262,7 +260,7 @@ int dhm_calc_secret( dhm_context *ctx,
     MPI_CHK( mpi_exp_mod( &ctx->K, &ctx->GY, &ctx->X,
                           &ctx->P, &ctx->RP ) );
 
-    if( ( ret = dhm_verifypub( &ctx->P, &ctx->GY ) ) != 0 )
+    if( ( ret = dhm_check_range( &ctx->GY, &ctx->P ) ) != 0 )
         return( ret );
 
     *olen = mpi_size( &ctx->K );

tests/suites/test_suite_version.data

@@ -1,5 +1,5 @@
 Check compiletime library version
-check_compiletime_version:"0.99.2"
+check_compiletime_version:"0.99.3"
 
 Check runtime library version
-check_runtime_version:"0.99.2"
+check_runtime_version:"0.99.3"