certbot / certbot/josepy

fields_to_partial_json() in jwk.py reads RSA private key

Open
#278 7 comments 0 reactions 1 assignee Claimed by @wgreenberg View on GitHub
Dominant language
Python
Stars
48
Forks
34
Avg merge
2m
Merged PRs (30d)
1

Description

Using an RSA provided by an HSM I discovered a code path where josepy attempted to read the private key "numbers" when calling challenge.validation() on a DNS challenge (passing in the RSAKey object).

The specific issue is on line 269, and then the values from that key are then read in 274-279.
https://github.com/certbot/josepy/blob/fbee9f206c6e26ed0b1cd9e2823e6be57af3e40e/src/josepy/jwk.py#L269

This in definitely incorrect since RSA private keys should be kept completely private, but does work when the the RSAPrivateKey allows you to read those numbers. However, if the RSA key is stored in an HSM this is (rightly) impossible.

Commenting out those lines appears to have no ill effect - at least on DNS challenges and Let's Encrypt's staging server. I was able to submit an order, retrieve the challenges, call .validate() on both the DNS and HTTP challenges, answer the DNS challenge, finalize the order, and retrieve the certificate.

I found a similar issue in the ECDSA code (lines 364, 366, 394), but did not do any testing on changing those.

I'm happy to provide a pull request if you would like, but thought I should open the issue first to discuss.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.