X.509 certificate validation with internal TLS implementation

[Jouni Malinen]

Source code review of the internal TLS implementation in hostap.git has
found insufficient validation steps for the signature field in X.509
certificates. While the digest value is verified to be correct, extra
padding after that value is not used to reject the certificate. This can
make it easier to generate forged certificates that would pass the
validation steps even without a valid signature, especially in the case
of a small public exponent (3) used in a CA certificate. This could be
used by rogue APs/authentication servers to bypass server
authentication in wpa_supplicant or rogue STA to bypass EAP-TLS client
authentication in hostapd.

This can affect EAP-TLS, EAP-TTLS, EAP-PEAP, and EAP-FAST server
certificate validation in wpa_suppliant and EAP-TLS client certificate
validation in hostapd if the internal TLS library is used. This is not
enabled by default (OpenSSL is used by default), but can be selected in
the build configuration (e.g., wpa_supplicant/.config and
hostapd/.config) with CONFIG_TLS=internal.

I'm not aware of any large scale use of the internal TLS implementation
included in hostap.git, but if it is used in any product for EAP-TLS,
EAP-TTLS, EAP-PEAP, or EAP-FAST authentication, I'm strongly
recommending following fixes to be applied to any such product to
address this issue.

http://w1.fi/cgit/hostap/commit/?id=9c29d48725fd40a82407a89f193cf009aeef9745
http://w1.fi/cgit/hostap/commit/?id=e6d83cc7babb978ba53ae8686159b41ab0f448cc
http://w1.fi/cgit/hostap/commit/?id=6c5be116dd6997f68e524247751cff53c74519d7

-- 
Jouni Malinen                                            PGP id EFC895FA