[Bug 60141] New: CertCreateSelfSignCertificate with default parameters makes insecure RSA 512 cert
http://bugs.winehq.org/show_bug.cgi?id=60141 Bug ID: 60141 Summary: CertCreateSelfSignCertificate with default parameters makes insecure RSA 512 cert Product: Wine Version: 10.0 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: crypt32 Assignee: wine-bugs@list.winehq.org Reporter: kedarh@microsoft.com Target Milestone: --- Distribution: --- Created attachment 81740 --> http://bugs.winehq.org/attachment.cgi?id=81740 sample program that creates a self signed cert using default parameters and writes it to disk On Win10+, if you call CertCreateSelfSignCertificate and pass in default parameters like hCryptProvOrNCryptKey=NULL and pKeyProvInfo=NULL, the resulting certificate has an RSA 1024 public key. On Wine 10.0, it generates a certificate with an RSA 512 key. There are a few significant downsides here: 1. It is a difference in behavior from Win10 and Win11 default configuration. 2. RSA 512 is widely considered to be deprecated. 3. RSA 512 does not work properly for signing and signature validation. See the bug I just filed: Bug 60140. Why point #3 matters is that in TLS, modern versions of Windows Server, rsa_pss_rsae_sha256 (0x0804) is at the top of the signature algorithm list in the Certificate Request message (when client certificates are used), so if the client generates an RSA 512 key, it will never succeed the TLS negotiation. There are surely clients using default parameters to CertCreateSelfSignCertificate that used to work, but will fail to connect to certain TLS servers now. I've attached a sample program that demonstrates the issue. ----- The reason why this is happening, at least in part, is that CertCreateSelfSignCertificate calls CRYPT_CreateKeyProv when hProv is not passed in, which calls if (CryptAcquireContextW( &hProv, container, MS_DEF_PROV_W, PROV_RSA_FULL, CRYPT_NEWKEYSET )) https://gitlab.winehq.org/wine/wine/-/blob/master/dlls/crypt32/cert.c#L3786 MS_DEF_PROV_W is the "Base" cryptographic provider, which is set to use the default key length 512: https://gitlab.winehq.org/wine/wine/-/blob/master/dlls/rsaenh/rsaenh.c?ref_t... On Windows, the default provider is set via registry key on a per purpose basis (can be different for signature, key exchange, etc..). A good way to fix this would be to use a similar registry lookup for it, and use the same default that Win10 and Win11 use today: the "Enhanced" provider. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60141 Ken Sharp <imwellcushtymelike@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, source URL| |https://bugs.winehq.org/att | |achment.cgi?id=81740 --- Comment #1 from Ken Sharp <imwellcushtymelike@gmail.com> --- Please upgrade and try again. https://gitlab.winehq.org/wine/wine/-/wikis/Download -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60141 Austin English <austinenglish@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |testcase -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60141 --- Comment #2 from Hans Leidekker <hans@meelstraat.net> --- (In reply to Kedar Hirve [MSFT] from comment #0)
On Windows, the default provider is set via registry key on a per purpose basis (can be different for signature, key exchange, etc..). A good way to fix this would be to use a similar registry lookup for it, and use the same default that Win10 and Win11 use today: the "Enhanced" provider.
Thanks for the bug report. I found that it's actually the "Strong" provider and I have submitted an MR to switch to that one: https://gitlab.winehq.org/wine/wine/-/merge_requests/11615 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60141 Hans Leidekker <hans@meelstraat.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Fixed by SHA1| |c86d1f726b56aeb85071728bafb | |afe43c3f42887 Resolution|--- |FIXED --- Comment #3 from Hans Leidekker <hans@meelstraat.net> --- Fixed with c86d1f726b56aeb85071728bafbafe43c3f42887. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60141 --- Comment #4 from Kedar Hirve [MSFT] <kedarh@microsoft.com> --- Thank you for fixing this and the other bug. That was a really fast turnaround! -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60141 Alexandre Julliard <julliard@winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #5 from Alexandre Julliard <julliard@winehq.org> --- Closing bugs fixed in 11.16. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla