yahoo-eng-team team mailing list archive

["Markus Zoeller \(markus_z\)" <mzoeller@xxxxxxxxxxxxxxxxxx>]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (LIBERTY, MITAKA, OCATA, NEWTON).
  Valid example: CONFIRMED FOR: LIBERTY


** Changed in: nova
   Importance: Low => Undecided

** Changed in: nova
       Status: Confirmed => Expired

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1368073

Title:
  [Security-NIST]SimpleDH in nova/virt/xenapi/agent.py does not fit the
  NIST

Status in OpenStack Compute (nova):
  Expired
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  class SimpleDH(object):
      """This class wraps all the functionality needed to implement
      basic Diffie-Hellman-Merkle key exchange in Python. It features
      intelligent defaults for the prime and base numbers needed for the
      calculation, while allowing you to supply your own. It requires that
      the openssl binary be installed on the system on which this is run,
      as it uses that to handle the encryption and decryption. If openssl
      is not available, a RuntimeError will be raised.
      """
      def __init__(self):
          self._prime = 162259276829213363391578010288127
          self._base = 5
          self._public = None
          self._shared = None
          self.generate_private()

      def generate_private(self):
          self._private = int(binascii.hexlify(os.urandom(10)), 16)
          return self._private

      def get_public(self):
          self._public = pow(self._base, self._private, self._prime)
          return self._public

      def compute_shared(self, other):
          self._shared = pow(other, self._private, self._prime)
          return self._shared

      def _run_ssl(self, text, decrypt=False):
          cmd = ['openssl', 'aes-128-cbc', '-A', '-a', '-pass',
                 'pass:%s' % self._shared, '-nosalt']
          if decrypt:
              cmd.append('-d')
          out, err = utils.execute(*cmd, process_input=text)
          if err:
              raise RuntimeError(_('OpenSSL error: %s') % err)
          return out

      def encrypt(self, text):
          return self._run_ssl(text).strip('\n')

      def decrypt(self, text):
          return self._run_ssl(text, decrypt=True)

          
  Nova use the SimpleDH to call the xen agent to set the root password of the instance.
   
  In NIST,  the DH algorithm need |p| = 2048 bit, and |q| = 224 or 256 bits
  In the SimpleDH, |q| = int(binascii.hexlify(os.urandom(10)), 16)
  It was only 24*4 = 96bit
  p = 162259276829213363391578010288127 is far less than 2048 bit
  So the SimpleDH is not fit the NIST

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1368073/+subscriptions