Redhat's file signatures fail to verify (because they use OpenPGP signatures with the old signature package V3) #358

bernhardreiter · 2023-04-26T07:58:38Z

Using csaf_distribution-v2.1.0-gnulinux-amd64: when downloading from redhat.com
the signatures do not verify.

curl -L -O https://github.com/csaf-poc/csaf_distribution/releases/download/v2.1.0-gnulinux-amd64.tar.gz
tar -xvmlzf csaf_distribution-v2.1.0-gnulinux-amd64.tar.gz
./csaf_distribution-v2.1.0-gnulinux-amd64/bin-linux-amd64/csaf_downloader --verbose --rate=10 redhat.com

[..]
2023/04/26 09:49:05 [GET]: https://access.redhat.com/security/data/csaf/v2/advisories/2001/rhsa-2001_058.json
[..]
2023/04/26 09:49:06 [GET]: https://access.redhat.com/security/data/csaf/v2/advisories/2001/rhsa-2001_058.json.asc
2023/04/26 09:49:06 Cannot verify signature for https://access.redhat.com/security/data/csaf/v2/advisories/2001/rhsa-2001_058.json
[..]
2023/04/26 09:55:32 Cannot verify signature for https://access.redhat.com/security/data/csaf/v2/advisories/2005/rhsa-2005_586.json
2023/04/26 09:55:32 [GET]: https://access.redhat.com/security/data/csaf/v2/advisories/2005/rhsa-2005_587.json
[..]

Manual checking shows that GnuPG believes in the signature, e.g.:

curl -O https://access.redhat.com/security/data/csaf/v2/advisories/2005/rhsa-2005_586.json
curl -O https://access.redhat.com/security/data/csaf/v2/advisories/2005/rhsa-2005_586.json.asc
gpg --keyserver keyserver2.gnupg.org --recv-keys "77E7 9ABE 9367 3533 ED09  EBE2 DCE3 8235 97F5 EAC4"

gpg -v --verify  rhsa-2005_586.json.asc
gpg: armor header: Version: GnuPG v1
gpg: assuming signed data in 'rhsa-2005_586.json'
gpg: Signature made Do 09 Mär 2023 20:57:15 CET
gpg:                using RSA key DCE3823597F5EAC4
gpg: using pgp trust model
gpg: Good signature from "Red Hat, Inc. (Product Security) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 77E7 9ABE 9367 3533 ED09  EBE2 DCE3 8235 97F5 EAC4
gpg: binary signature, digest algorithm SHA256, key algorithm rsa4096

The text was updated successfully, but these errors were encountered:

bernhardreiter · 2023-04-26T07:59:43Z

@tschmidtb51 we shall investigate, I assume.

@bernhard-herzog can you add your code, to getare more verbose error message from the failed signature

s-l-teichmann · 2023-04-26T09:31:21Z

I checked out main and upgraded the 3rdparty libs with
go get -u -v ./... and rebuilt the checker and it works.

bernhard-herzog · 2023-04-26T09:40:54Z

Further digging with a debugger reveals that the signature check fails because the signature (I used rhsa-2001_058.json.asc) uses signature packet format version 3 which is not supported by go-crypto.

The code there even produces an error with that information, but detail is then lost in the openpgp library where a more generic "Invalid signature" is returned instead. The CSAF code also suppresses information because any failure during the signature check is turned into a simple boolean and is the reported as "Cannot verify signature ...", so details on why the check failed are lost.

bernhard-herzog · 2023-04-26T09:54:39Z

I checked out main and upgraded the 3rdparty libs with
go get -u -v ./... and rebuilt the checker and it works.

It still doesn't work for me. The code in question that rejects packet
version 3 hasn't changed, so I don't think it could work for the
signatures I observed the problem with. All of those are in the 2001
subdirectory, I haven't checked any others.

s-l-teichmann · 2023-04-26T09:56:29Z

I checked out main and upgraded the 3rdparty libs with go get -u -v ./... and rebuilt the checker and it works.

Argh! I used the checker and not the downloader. I can confirm that updating the libs does not help.

bernhardreiter · 2023-04-26T10:09:39Z

@s-l-teichmann does signature validation work with the checker, though? ;)

bernhardreiter · 2023-04-26T10:30:15Z

Seems to be ProtonMail/go-crypto#164 which is biting a few people already.

gpg -vv --verify  rhsa-2005_586.json.ascgpg: armor: BEGIN PGP SIGNATURE
gpg: armor header: Version: GnuPG v1
# off=0 ctb=89 tag=2 hlen=3 plen=533
:signature packet: algo 1, keyid DCE3823597F5EAC4
        version 3, created 1678391835, md5len 5, sigclass 0x00
        digest algo 8, begin of digest 5a d6
        data: [4095 bits]
gpg: assuming signed data in 'rhsa-2005_586.json'
gpg: Signature made Do 09 Mär 2023 20:57:15 CET
gpg:                using RSA key DCE3823597F5EAC4
[..]

bernhardreiter · 2023-04-26T10:41:18Z

Note that https://www.rfc-editor.org/rfc/rfc4880#section-5.2 reads

Implementations SHOULD accept V3 signatures. Implementations SHOULD
generate V4 signatures.

(Note that Implementation in the quote refers to implementing OpenPGP itself, not our implementation of the downloader.)

The SHOULD means that Redhat would need to have valid reasons in particular circumstances to create v3 signatures here. Given that their signature has Version: GnuPG v1, they probably should not have created it in 2023. Unless there are special circumstances I'd say that CSAF should mandate at least V4 signatures, because CSAF is a new application and can thus set a modern requirement here.

bernhardreiter · 2023-04-26T10:45:35Z

@bernhard-herzog can you put in better diagnostic reporting and then assign it to @tschmidtb51 ?

s-l-teichmann · 2023-04-26T13:32:01Z

@bernhardreiter

@s-l-teichmann does signature validation work with the checker, though? ;)

Obviously not. But the failure is noted in the report and not on STDERR where i had looked for the message.

tschmidtb51 · 2023-05-01T06:22:09Z

@tschmidtb51 we shall investigate, I assume.

Yes. Go ahead.

s-l-teichmann · 2023-05-02T09:26:23Z

PR #363 added a flag ignoresigcheck to ignore the results of the signature checks in the downloader.
Without this the downloads would fail entirely.

andrewgdotcom · 2023-05-09T08:27:15Z

There is a soft fork of go-crypto at https://github.com/pgpkeys-eu/go-crypto that restores V3 support.

Add the following to go.mod to try it out:

replace github.com/ProtonMail/go-crypto => github.com/pgpkeys-eu/go-crypto v0.0.0-20230506215654-16de0cc09494

bernhardreiter · 2023-05-09T10:08:05Z

@andrewgdotcom thanks for the hint.

(We are not sure yet, if it wouldn't be better to mandate v4 or higher signatures in the CSAF standard directly. At least V4 SHOULD already be used unless we know the reasoning of Redhat.)

andrewgdotcom · 2023-05-09T10:50:25Z

RedHat didn't have any reasoning, they just forgot about it:

https://bugzilla.rpmfusion.org/show_bug.cgi?id=6496

bernhardreiter · 2023-05-09T12:38:29Z

RedHat didn't have any reasoning, they just forgot about it:
https://bugzilla.rpmfusion.org/show_bug.cgi?id=6496

That is packaging, I mean fresh CSAF publications (see beginning of this issue). :)

bernhardreiter · 2023-05-09T13:25:04Z

I've just send an email to Redhat, asking if they could change the signature. Got the contact address from https://www.redhat.com/en/blog/csaf-vex-documents-now-generally-available , the CSAF providermetadata file and https://access.redhat.com/security/team/contact/ .

bernhardreiter · 2023-05-10T07:40:05Z

There is a new issue https://issues.redhat.com/browse/SECDATA-300 which will lead to new signatures on the files. However, so far it does not say something about the signature packet format, which is the problem here.

We shall stop working on the issue, until we see what Redhat does here.

(We have ignoresigcheck and a better diagnostic message in place already, if I remember correctly.)

bernhardreiter · 2023-05-10T15:24:55Z

There is a new issue https://issues.redhat.com/browse/SECDATA-300 which will lead to new signatures on the files. However, so far it does not say something about the signature packet format, which is the problem here.

I'll asked Redhat about it.

bernhardreiter · 2023-05-17T07:12:31Z

Redhat has responded and gave me a new issue, they will address:
https://issues.redhat.com/browse/SECDATA-304

bernhardreiter · 2023-07-05T18:20:31Z

Redhat has made some improvements, so there are now files which have an OpenPGP signature format version 4, which is fine. However not all files have been resigned yet.

A file that works:
https://access.redhat.com/security/data/csaf/v2/advisories/2001/rhsa-2001_164.json

Some that do not:

https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_251.json

https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_259.json

https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_270.json
https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_271.json
https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_287.json
https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_288.json
https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_289.json
https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_290.json

bernhardreiter · 2023-10-10T14:56:05Z

https://issues.redhat.com/browse/SECDATA-304 has been closed, but

curl -O https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_290.json
curl -O https://access.redhat.com/security/data/csaf/v2/advisories/2002/rhsa-2002_290.json.asc
gpg -vv --verify rhsa-2002_290.json.asc

:signature packet: algo 1, keyid DCE3823597F5EAC4
        version 3, created 1675238242, md5len 5, sigclass 0x00
        digest algo 8, begin of digest 40 b6
        data: [4093 bits]
gpg: assuming signed data in 'rhsa-2002_290.json'
gpg: Signature made Mi 01 Feb 2023 08:57:22 CET
gpg:                using RSA key DCE3823597F5EAC4

So it is still broken (which can be seen from the version 3 and the time (before June 2023).

bernhardreiter added the csaf_downloader label Apr 26, 2023

bernhardreiter assigned bernhard-herzog Apr 26, 2023

bernhardreiter changed the title ~~Signatures does not verify for redhat.com~~ Signatures by old OpenPGP V3 standard do not verify Apr 26, 2023

bernhardreiter changed the title ~~Signatures by old OpenPGP V3 standard do not verify~~ OpenPGP signatures using the old signature package V3 fail to verify Apr 26, 2023

bernhardreiter changed the title ~~OpenPGP signatures using the old signature package V3 fail to verify~~ OpenPGP signatures using the old signature package V3 do not verify Apr 26, 2023

s-l-teichmann mentioned this issue Apr 26, 2023

Be more verbose in case of signature check failures #361

Merged

tschmidtb51 added the service+dev label May 1, 2023

bernhardreiter unassigned bernhard-herzog May 10, 2023

bernhardreiter added csaf_checker and removed service+dev labels May 10, 2023

bernhardreiter changed the title ~~OpenPGP signatures using the old signature package V3 do not verify~~ Redhat's file signatures fail to verify (because they use OpenPGP signatures with the old signature package V3) Jul 5, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Redhat's file signatures fail to verify (because they use OpenPGP signatures with the old signature package V3) #358

Redhat's file signatures fail to verify (because they use OpenPGP signatures with the old signature package V3) #358

bernhardreiter commented Apr 26, 2023

bernhardreiter commented Apr 26, 2023

s-l-teichmann commented Apr 26, 2023

bernhard-herzog commented Apr 26, 2023

bernhard-herzog commented Apr 26, 2023

s-l-teichmann commented Apr 26, 2023

bernhardreiter commented Apr 26, 2023

bernhardreiter commented Apr 26, 2023 •

edited

Loading

bernhardreiter commented Apr 26, 2023 •

edited

Loading

bernhardreiter commented Apr 26, 2023

s-l-teichmann commented Apr 26, 2023

tschmidtb51 commented May 1, 2023

s-l-teichmann commented May 2, 2023

andrewgdotcom commented May 9, 2023 •

edited

Loading

bernhardreiter commented May 9, 2023

andrewgdotcom commented May 9, 2023

bernhardreiter commented May 9, 2023

bernhardreiter commented May 9, 2023

bernhardreiter commented May 10, 2023

bernhardreiter commented May 10, 2023

bernhardreiter commented May 17, 2023 •

edited

Loading

bernhardreiter commented Jul 5, 2023 •

edited

Loading

bernhardreiter commented Oct 10, 2023

Redhat's file signatures fail to verify (because they use OpenPGP signatures with the old signature package V3) #358

Redhat's file signatures fail to verify (because they use OpenPGP signatures with the old signature package V3) #358

Comments

bernhardreiter commented Apr 26, 2023

bernhardreiter commented Apr 26, 2023

s-l-teichmann commented Apr 26, 2023

bernhard-herzog commented Apr 26, 2023

bernhard-herzog commented Apr 26, 2023

s-l-teichmann commented Apr 26, 2023

bernhardreiter commented Apr 26, 2023

bernhardreiter commented Apr 26, 2023 • edited Loading

bernhardreiter commented Apr 26, 2023 • edited Loading

bernhardreiter commented Apr 26, 2023

s-l-teichmann commented Apr 26, 2023

tschmidtb51 commented May 1, 2023

s-l-teichmann commented May 2, 2023

andrewgdotcom commented May 9, 2023 • edited Loading

bernhardreiter commented May 9, 2023

andrewgdotcom commented May 9, 2023

bernhardreiter commented May 9, 2023

bernhardreiter commented May 9, 2023

bernhardreiter commented May 10, 2023

bernhardreiter commented May 10, 2023

bernhardreiter commented May 17, 2023 • edited Loading

bernhardreiter commented Jul 5, 2023 • edited Loading

bernhardreiter commented Oct 10, 2023

bernhardreiter commented Apr 26, 2023 •

edited

Loading

bernhardreiter commented Apr 26, 2023 •

edited

Loading

andrewgdotcom commented May 9, 2023 •

edited

Loading

bernhardreiter commented May 17, 2023 •

edited

Loading

bernhardreiter commented Jul 5, 2023 •

edited

Loading