libtls: As client, reject DH exchanges using primes smaller than 1024 bit

While the server signs the ephemeral DH parameters, it can be tricked to its
lowest supported DH group by a man-in-the-middle:

  https://weakdh.org/imperfect-forward-secrecy.pdf

While we at least use 2048-bit DH groups as server, the client accepts any
DH prime the server sends. If it supports export ciphers, only a 512-bit prime
may be used.

As TLS does not define nor negotiate a DH group for cipher suites, the client
actually must accept what the server offers. To avoid downgrades to weak
DH groups, we must reject what we consider insecure. We set this limit to
1024-bit primes. While this breaks compatibility with TLS servers using weaker
primes, this is what we expect servers at least use. Most browser vendors use
the same limit in a similar fix.

diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c
index 86b94ab85775cb6822c79cc109f94ee6813cba45..000dda43bd47e8ea33872892c337179909c4e4f7 100644 (file)
--- a/src/libtls/tls_peer.c
+++ b/src/libtls/tls_peer.c
@@ -354,6 +354,13 @@ static status_t process_modp_key_exchange(private_tls_peer_t *this,
                this->alert->add(this->alert, TLS_FATAL, TLS_DECODE_ERROR);
                return NEED_MORE;
        }
+       /* reject (export) DH groups using primes smaller than 1024 bit */
+       if (prime.len < 1024 / 8)
+       {
+               DBG1(DBG_TLS, "short DH prime received (%zu bytes)", prime.len);
+               this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
+               return NEED_MORE;
+       }
        public = find_public_key(this);
        if (!public)
        {