Disable insecure hash algorithms by default

We add a new option on the configuratio which toggles the use of hash
algorithms that are deemed insecure. We default to disallowing insecure
hash algorithms, MD2 (which we don't support at all), MD5 and SHA-1.

When parsing signature algorithms we check whether it's being passed an
insecure hash algorithm, and whether we are configured to allow it or
not. If we don't allow it, we omit adding it, to ensure we never
advertise this capability.

Author: daenney

config.go

@@ -57,6 +57,10 @@ type Config struct {
 	// This should be used only for testing.
 	InsecureSkipVerify bool
 
+	// InsecureHashes allows the use of hashing algorithms that are known
+	// to be vulnerable.
+	InsecureHashes bool
+
 	// VerifyPeerCertificate, if not nil, is called after normal
 	// certificate verification by either a client or server. It
 	// receives the certificate provided by the peer and also a flag

conn.go

@@ -83,7 +83,7 @@ func createConn(ctx context.Context, nextConn net.Conn, config *Config, isClient
 		return nil, err
 	}
 
-	signatureSchemes, err := parseSignatureSchemes(config.SignatureSchemes)
+	signatureSchemes, err := parseSignatureSchemes(config.SignatureSchemes, config.InsecureHashes)
 	if err != nil {
 		return nil, err
 	}

hash_algorithm.go

@@ -14,7 +14,7 @@ type hashAlgorithm uint16
 
 // Supported hash hash algorithms
 const (
-	// hashAlgorithmMD2    hashAlgorithm = 0 // Blacklisted
+	hashAlgorithmMD2     hashAlgorithm = 0 // Blacklisted
 	hashAlgorithmMD5     hashAlgorithm = 1 // Blacklisted
 	hashAlgorithmSHA1    hashAlgorithm = 2 // Blacklisted
 	hashAlgorithmSHA224  hashAlgorithm = 3
@@ -27,6 +27,8 @@ const (
 // String makes hashAlgorithm printable
 func (h hashAlgorithm) String() string {
 	switch h {
+	case hashAlgorithmMD2:
+		return "md2"
 	case hashAlgorithmMD5:
 		return "md5" // [RFC3279]
 	case hashAlgorithmSHA1:
@@ -42,7 +44,7 @@ func (h hashAlgorithm) String() string {
 	case hashAlgorithmEd25519:
 		return "null"
 	default:
-		return "unknown hash algorithm"
+		return "unknown or unsupported hash algorithm"
 	}
 }
 
@@ -71,6 +73,15 @@ func (h hashAlgorithm) digest(b []byte) []byte {
 	}
 }
 
+func (h hashAlgorithm) insecure() bool {
+	switch h {
+	case hashAlgorithmMD2, hashAlgorithmMD5, hashAlgorithmSHA1:
+		return true
+	default:
+		return false
+	}
+}
+
 func (h hashAlgorithm) cryptoHash() crypto.Hash {
 	switch h {
 	case hashAlgorithmMD5:
@@ -88,7 +99,7 @@ func (h hashAlgorithm) cryptoHash() crypto.Hash {
 	case hashAlgorithmEd25519:
 		return crypto.Hash(0)
 	default:
-		return 0
+		return crypto.Hash(0)
 	}
 }
 

signature_hash_algorithm.go

@@ -53,7 +53,7 @@ func (s *signatureHashAlgorithm) isCompatible(privateKey crypto.PrivateKey) bool
 
 // parseSignatureSchemes translates []tls.SignatureScheme to []signatureHashAlgorithm.
 // It returns default signature scheme list if no SignatureScheme is passed.
-func parseSignatureSchemes(sigs []tls.SignatureScheme) ([]signatureHashAlgorithm, error) {
+func parseSignatureSchemes(sigs []tls.SignatureScheme, insecureHashes bool) ([]signatureHashAlgorithm, error) {
 	if len(sigs) == 0 {
 		return defaultSignatureSchemes(), nil
 	}
@@ -71,10 +71,18 @@ func parseSignatureSchemes(sigs []tls.SignatureScheme) ([]signatureHashAlgorithm
 				xerrors.Errorf("SignatureScheme %04x: %w", ss, errInvalidHashAlgorithm),
 			}
 		}
+		if h.insecure() && !insecureHashes {
+			continue
+		}
 		out = append(out, signatureHashAlgorithm{
 			hash:      h,
 			signature: sig,
 		})
 	}
+
+	if len(out) == 0 {
+		return nil, errNoAvailableSignatureSchemes
+	}
+
 	return out, nil
 }

signature_hash_algorithm_go113_test.go

@@ -12,9 +12,10 @@ import (
 
 func TestParseSignatureSchemes_Ed25519(t *testing.T) {
 	cases := map[string]struct {
-		input    []tls.SignatureScheme
-		expected []signatureHashAlgorithm
-		err      error
+		input          []tls.SignatureScheme
+		expected       []signatureHashAlgorithm
+		err            error
+		insecureHashes bool
 	}{
 		"Translate": {
 			input: []tls.SignatureScheme{
@@ -23,14 +24,15 @@ func TestParseSignatureSchemes_Ed25519(t *testing.T) {
 			expected: []signatureHashAlgorithm{
 				{hashAlgorithmEd25519, signatureAlgorithmEd25519},
 			},
-			err: nil,
+			err:            nil,
+			insecureHashes: false,
 		},
 	}
 
 	for name, testCase := range cases {
 		testCase := testCase
 		t.Run(name, func(t *testing.T) {
-			output, err := parseSignatureSchemes(testCase.input)
+			output, err := parseSignatureSchemes(testCase.input, testCase.insecureHashes)
 			if testCase.err != nil && !xerrors.Is(err, testCase.err) {
 				t.Fatalf("Expected error: %v, got: %v", testCase.err, err)
 			}

signature_hash_algorithm_test.go

@@ -10,9 +10,10 @@ import (
 
 func TestParseSignatureSchemes(t *testing.T) {
 	cases := map[string]struct {
-		input    []tls.SignatureScheme
-		expected []signatureHashAlgorithm
-		err      error
+		input          []tls.SignatureScheme
+		expected       []signatureHashAlgorithm
+		err            error
+		insecureHashes bool
 	}{
 		"Translate": {
 			input: []tls.SignatureScheme{
@@ -31,30 +32,63 @@ func TestParseSignatureSchemes(t *testing.T) {
 				{hashAlgorithmSHA384, signatureAlgorithmRSA},
 				{hashAlgorithmSHA512, signatureAlgorithmRSA},
 			},
-			err: nil,
+			insecureHashes: false,
+			err:            nil,
 		},
 		"InvalidSignatureAlgorithm": {
 			input: []tls.SignatureScheme{
 				tls.ECDSAWithP256AndSHA256, // Valid
 				0x04FF,                     // Invalid: unknown signature with SHA-256
 			},
-			expected: nil,
-			err:      errInvalidSignatureAlgorithm,
+			expected:       nil,
+			insecureHashes: false,
+			err:            errInvalidSignatureAlgorithm,
 		},
 		"InvalidHashAlgorithm": {
 			input: []tls.SignatureScheme{
 				tls.ECDSAWithP256AndSHA256, // Valid
 				0x0003,                     // Invalid: ECDSA with MD2
 			},
-			expected: nil,
-			err:      errInvalidHashAlgorithm,
+			expected:       nil,
+			insecureHashes: false,
+			err:            errInvalidHashAlgorithm,
+		},
+		"InsecureHashAlgorithmDenied": {
+			input: []tls.SignatureScheme{
+				tls.ECDSAWithP256AndSHA256, // Valid
+				tls.ECDSAWithSHA1,          // Insecure
+			},
+			expected: []signatureHashAlgorithm{
+				{hashAlgorithmSHA256, signatureAlgorithmECDSA},
+			},
+			insecureHashes: false,
+			err:            nil,
+		},
+		"InsecureHashAlgorithmAllowed": {
+			input: []tls.SignatureScheme{
+				tls.ECDSAWithP256AndSHA256, // Valid
+				tls.ECDSAWithSHA1,          // Insecure
+			},
+			expected: []signatureHashAlgorithm{
+				{hashAlgorithmSHA256, signatureAlgorithmECDSA},
+				{hashAlgorithmSHA1, signatureAlgorithmECDSA},
+			},
+			insecureHashes: true,
+			err:            nil,
+		},
+		"OnlyInsecureHashAlgorithm": {
+			input: []tls.SignatureScheme{
+				tls.ECDSAWithSHA1, // Insecure
+			},
+			insecureHashes: false,
+			err:            errNoAvailableSignatureSchemes,
 		},
 	}
 
 	for name, testCase := range cases {
 		testCase := testCase
 		t.Run(name, func(t *testing.T) {
-			output, err := parseSignatureSchemes(testCase.input)
+			output, err := parseSignatureSchemes(testCase.input, testCase.insecureHashes)
 			if testCase.err != nil && !xerrors.Is(err, testCase.err) {
 				t.Fatalf("Expected error: %v, got: %v", testCase.err, err)
 			}