diff --git a/libgcrypt-1.10.2-cipher-ecc-only-accept-canonical-value-o-817bfd4.patch b/libgcrypt-1.10.2-cipher-ecc-only-accept-canonical-value-o-817bfd4.patch new file mode 100644 index 0000000000000000000000000000000000000000..a01b317e5a2981b02c30fec8ad359f5fd3f5469d --- /dev/null +++ b/libgcrypt-1.10.2-cipher-ecc-only-accept-canonical-value-o-817bfd4.patch @@ -0,0 +1,32 @@ +From 817bfd451b084172fddfceabda64fc8153f5c43b Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Tue, 11 Aug 2026 13:48:52 +0900 +Subject: [PATCH] cipher:ecc: Only accept canonical value of S. + +* cipher/ecc-eddsa.c (_gcry_ecc_eddsa_verify): Reject +non-canonical S. + +-- + +GnuPG-bug-id: 8386 +Reported-by: JEAN Jeremy +Signed-off-by: NIIBE Yutaka +--- + cipher/ecc-eddsa.c | 5 +++++ + 1 file changed, 5 insertions(+) +diff --git a/cipher/ecc-eddsa.c b/cipher/ecc-eddsa.c +index ce79b48..9415034 100644 +--- a/cipher/ecc-eddsa.c ++++ b/cipher/ecc-eddsa.c +@@ -1051,6 +1051,11 @@ _gcry_ecc_eddsa_verify (gcry_mpi_t input, mpi_ec_t ec, + rc = GPG_ERR_INV_LENGTH; + goto leave; + } ++ if (mpi_cmp (s, ec->n) >= 0) ++ { ++ rc = GPG_ERR_BAD_SIGNATURE; ++ goto leave; ++ } + } + + _gcry_mpi_ec_mul_point (&Ia, s, ec->G, ec); diff --git a/libgcrypt-1.10.2-cipher-ecc-sm2-use-constant-time-memequa-8643186.patch b/libgcrypt-1.10.2-cipher-ecc-sm2-use-constant-time-memequa-8643186.patch new file mode 100644 index 0000000000000000000000000000000000000000..f86dda43123e258ce7e3d77233cba4a8c161e84b --- /dev/null +++ b/libgcrypt-1.10.2-cipher-ecc-sm2-use-constant-time-memequa-8643186.patch @@ -0,0 +1,49 @@ +From 8643186e0f63470af44c3a7523aa8fed480dee41 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Tue, 11 Aug 2026 15:12:48 +0900 +Subject: [PATCH] cipher:ecc:sm2: Use constant time memequal to check. + +* cipher/ecc-sm2.c (_gcry_ecc_sm2_decrypt): Use wipememory +and ct_not_memequal. + +-- + +GnuPG-bug-id: 8395 +Reported-by: JEAN Jeremy +Signed-off-by: NIIBE Yutaka +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + cipher/ecc-sm2.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/cipher/ecc-sm2.c b/cipher/ecc-sm2.c +index c52629f..435ed4f 100644 +--- a/cipher/ecc-sm2.c ++++ b/cipher/ecc-sm2.c +@@ -31,6 +31,7 @@ + #include "ec-context.h" + #include "pubkey-internal.h" + #include "ecc-common.h" ++#include "bufhelp.h" + + #define MPI_NBYTES(m) ((mpi_get_nbits(m) + 7) / 8) + +@@ -326,15 +327,15 @@ _gcry_ecc_sm2_decrypt (gcry_sexp_t *r_plain, gcry_sexp_t data_list, mpi_ec_t ec) + dgst = _gcry_md_read (md, algo); + if (dgst == NULL) + { +- memset (plain, 0, inlen); ++ wipememory (plain, inlen); + rc = GPG_ERR_DIGEST_ALGO; + goto leave_main; + } + c3 = mpi_get_opaque (data_c3, &c3_len); + c3_len = (c3_len + 7) / 8; +- if (c3_len != mdlen || memcmp (dgst, c3, c3_len) != 0) ++ if (c3_len != mdlen || !buf_eq_const (dgst, c3, c3_len)) + { +- memset (plain, 0, inlen); ++ wipememory (plain, inlen); + rc = GPG_ERR_INV_DATA; + goto leave_main; + } diff --git a/libgcrypt-1.10.2-cipher-rsa-only-accept-canonical-signatu-742f8c1.patch b/libgcrypt-1.10.2-cipher-rsa-only-accept-canonical-signatu-742f8c1.patch new file mode 100644 index 0000000000000000000000000000000000000000..c097ab667120da2067c9b113ee9fb6344e18cda5 --- /dev/null +++ b/libgcrypt-1.10.2-cipher-rsa-only-accept-canonical-signatu-742f8c1.patch @@ -0,0 +1,46 @@ +From 742f8c149161adeab4b96459170fde363e6ae299 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Tue, 11 Aug 2026 14:33:43 +0900 +Subject: [PATCH] cipher:rsa: Only accept canonical signature. + +* cipher/rsa.c (rsa_verify): Reject if it's <= 0. Reject if it's +larger than or equal to N. + +-- + +GnuPG-bug-id: 8392 +Reported-by: JEAN Jeremy +Signed-off-by: NIIBE Yutaka +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + cipher/rsa.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/cipher/rsa.c b/cipher/rsa.c +index b2ca386..f02efa7 100644 +--- a/cipher/rsa.c ++++ b/cipher/rsa.c +@@ -1704,6 +1704,11 @@ rsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) + goto leave; + if (DBG_CIPHER) + log_printmpi ("rsa_verify sig", sig); ++ if (sig->sign) ++ { ++ rc = GPG_ERR_BAD_SIGNATURE; ++ goto leave; ++ } + + /* Extract the key. */ + rc = sexp_extract_param (keyparms, NULL, "ne", &pk.n, &pk.e, NULL); +@@ -1714,6 +1719,11 @@ rsa_verify (gcry_sexp_t s_sig, gcry_sexp_t s_data, gcry_sexp_t keyparms) + log_printmpi ("rsa_verify n", pk.n); + log_printmpi ("rsa_verify e", pk.e); + } ++ if (mpi_cmp (sig, pk.n) >= 0) ++ { ++ rc = GPG_ERR_BAD_SIGNATURE; ++ goto leave; ++ } + + /* Do RSA computation and compare. */ + result = mpi_new (0); diff --git a/libgcrypt.spec b/libgcrypt.spec index f66732b6866a4b0117fb6becf34f7c7d8803c10c..47d48be36ea82c750226de1113790fa8b81fb0d4 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -2,7 +2,7 @@ Summary: A general purpose cryptographic library originally based on code from GnuPG Name: libgcrypt Version: 1.10.2 -Release: 7%{?dist} +Release: 8%{?dist} License: LGPLv2.1+ URL: https://www.gnupg.org/software/libgcrypt/index.html Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 @@ -13,6 +13,13 @@ Patch0001: libgcrypt-1.10.0-marvin.patch Patch0002: libgcrypt-1.10.0-marvin2.patch # https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/ Patch0003: libgcrypt-1.10.0-marvin3.patch +# Backport upstream security fixes +# 817bfd4: cipher:ecc: Only accept canonical value of S (EdDSA signature malleability) +# 8643186: cipher:ecc:sm2: Use constant time memequal to check (SM2 timing side-channel) +# 742f8c1: cipher:rsa: Only accept canonical signature (RSA signature verification) +Patch0004: libgcrypt-1.10.2-cipher-ecc-only-accept-canonical-value-o-817bfd4.patch +Patch0005: libgcrypt-1.10.2-cipher-ecc-sm2-use-constant-time-memequa-8643186.patch +Patch0006: libgcrypt-1.10.2-cipher-rsa-only-accept-canonical-signatu-742f8c1.patch Patch3000: libgcrypt-1.10.0-disable-brainpool.patch # Feature for SMx support @@ -138,6 +145,10 @@ LIBGCRYPT_FORCE_FIPS_MODE=1 make check %changelog +* Thu Aug 13 2026 PkgAgent Robot - 1.10.2-8 +- [Type] security +- [DESC] Fix EdDSA non-canonical S (817bfd4), SM2 constant-time memequal (8643186), RSA non-canonical signature (742f8c1) + * Wed Mar 04 2026 Xinlong Chen - 1.10.2-7 - Add benchmark for pts/gcrypt