Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Summary

forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and the PKCS#12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS#12/PFX file and compute a MAC that verifies with any password; PKCS#12 PBE-encrypted private keys prepared the same way decrypt with any password. Fixed in node-forge 1.4.1.

Details

p12.pkcs12FromAsn1() in lib/pkcs12.js reads the MAC iteration count (MacData.iterations) from the input and passes it to the PKCS#12 key derivation function pki.pbe.generatePkcs12Key() in lib/pbe.js (also exposed as forge.pkcs12.generateKey()) without checking that it is at least 1. The key derivation function (RFC 7292 Appendix B.2) runs its hash loop iter times. With an iteration count of 0 (or an empty or negative INTEGER), no hashing is done and the function returns the PKCS#12 diversifier ID byte repeated, for example 0x03 repeated 20 times for an HMAC-SHA1 MAC key. The result does not depend on the password or the salt, so anyone can compute a valid MAC over arbitrary PFX contents.

The same key derivation function is used by pki.pbe.getCipherForPKCS12PBE() for the PKCS#12 password-based encryption schemes pbeWithSHAAnd3-KeyTripleDES-CBC and pbewithSHAAnd40BitRC2-CBC, whose pkcs-12PbeParams iteration count is also read from the input. With an iteration count of 0 or less, the encryption key and IV are constants (0x01 and 0x02 repeated). This is reached from shrouded key bags and encrypted SafeContents in pkcs12FromAsn1(), and from forge.pki.decryptPrivateKeyInfo() (for example for ENCRYPTED PRIVATE KEY PEM input).

RFC 7292 defines MacData with iterations INTEGER DEFAULT 1; an iteration count only makes sense as 1 or more (RFC 8018 uses INTEGER (1..MAX) for the same concept). PBES2 (PBKDF2) encrypted content is not affected.

The fix rejects iteration counts less than 1 when verifying a PKCS#12 MAC in pkcs12FromAsn1() ("PKCS#12 MAC iteration count must be >= 1.") and at the entry of pki.pbe.generatePkcs12Key() ("PKCS#12 key derivation iteration count must be >= 1."), which covers the MAC, both PKCS#12 PBE schemes and direct forge.pkcs12.generateKey() callers.

Patches

Fixed in node-forge 1.4.1. Iteration counts less than 1 are now rejected when verifying a PKCS#12 MAC and in the PKCS#12 key derivation function.

Workarounds

Before calling forge.pkcs12.pkcs12FromAsn1(), reject inputs whose MacData.iterations is present and less than 1. For encrypted private keys using the PKCS#12 PBE schemes, there is no simple workaround other than checking the pkcs-12PbeParams iteration count before decryption, or upgrading.

Credits

Reported by Thai, Calif.io in collaboration with Claude and Anthropic Research.

Proof of concept

Take any PKCS#12/PFX file, replace its AuthenticatedSafe with attacker-chosen content (for example the attacker's certificate and an unencrypted private key), set MacData.iterations to 0 (DER 02 01 00), and compute the HMAC-SHA1 over the new content with the key 0x03 repeated 20 times. On node-forge