Skip to content

Commit 31a9bea

Browse files
mxsashamxsasha
committed
Remove RSA-PKCS test
This was removed from NCSC TLS update.
1 parent 19ac66a commit 31a9bea

11 files changed

Lines changed: 1 addition & 171 deletions

File tree

‎checks/categories.py‎

Lines changed: 1 addition & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
from typing import Optional
44

55
from checks import scoring
6-
from checks.models import TLSClientInitiatedRenegotiationStatus, KexRSAPKCSStatus, TLSExtendedMasterSecretStatus
6+
from checks.models import TLSClientInitiatedRenegotiationStatus, TLSExtendedMasterSecretStatus
77
from checks.scoring import (
88
ORDERED_STATUSES,
99
STATUS_ERROR,
@@ -185,7 +185,6 @@ def __init__(self, name="web-tls"):
185185
WebTlsZeroRTT,
186186
WebTlsOCSPStapling,
187187
WebTlsKexHashFunc,
188-
WebTlsKexRSAPKCSStatus,
189188
WebTLSExtendedMasterSecret,
190189
# WebTlsDaneRollover,
191190
]
@@ -259,7 +258,6 @@ def __init__(self, name="mail-tls"):
259258
MailTlsDaneRollover,
260259
MailTlsZeroRTT,
261260
MailTlsKexHashFunc,
262-
MailTlsKexRSAPKCSStatus,
263261
MailTLSExtendedMasterSecret,
264262
# MailTlsOCSPStapling, # Disabled for mail.
265263
]
@@ -1536,42 +1534,6 @@ def result_phase_out(self, tech_data):
15361534
self.tech_data = tech_data
15371535

15381536

1539-
class WebTlsKexRSAPKCSStatus(Subtest):
1540-
def __init__(self):
1541-
super().__init__(
1542-
name="key_exchange_rsa_pkcs",
1543-
label="detail web tls key-exchange-rsa-pkcs label",
1544-
explanation="detail web tls key-exchange-rsa-pkcs exp",
1545-
tech_string="detail web tls key-exchange-rsa-pkcs tech table",
1546-
worst_status=scoring.STATUS_INFO,
1547-
full_score=scoring.TLS_KEX_RSA_PKCS_GOOD,
1548-
model_score_field="key_exchange_rsa_pkcs_score",
1549-
)
1550-
1551-
def save_result(self, status: KexRSAPKCSStatus):
1552-
handlers = {
1553-
KexRSAPKCSStatus.good: self.result_good,
1554-
KexRSAPKCSStatus.bad: self.result_bad,
1555-
KexRSAPKCSStatus.unknown: self.result_unknown,
1556-
}
1557-
return handlers[status]()
1558-
1559-
def result_good(self):
1560-
self._status(STATUS_SUCCESS)
1561-
self.verdict = "detail web tls key-exchange-rsa-pkcs verdict good"
1562-
self.tech_data = "detail tech data good"
1563-
1564-
def result_bad(self):
1565-
self._status(STATUS_FAIL)
1566-
self.verdict = "detail web tls key-exchange-rsa-pkcs verdict bad"
1567-
self.tech_data = "detail tech data insufficient"
1568-
1569-
def result_unknown(self):
1570-
self._status(STATUS_INFO)
1571-
self.verdict = "detail web tls key-exchange-rsa-pkcs verdict other"
1572-
self.tech_data = "detail tech data not-applicable"
1573-
1574-
15751537
class WebTLSExtendedMasterSecret(Subtest):
15761538
def __init__(self):
15771539
super().__init__(
@@ -2205,42 +2167,6 @@ def result_phase_out(self, tech_data):
22052167
self.tech_data = tech_data
22062168

22072169

2208-
class MailTlsKexRSAPKCSStatus(Subtest):
2209-
def __init__(self):
2210-
super().__init__(
2211-
name="key_exchange_rsa_pkcs",
2212-
label="detail mail tls key-exchange-rsa-pkcs label",
2213-
explanation="detail mail tls key-exchange-rsa-pkcs exp",
2214-
tech_string="detail mail tls key-exchange-rsa-pkcs tech table",
2215-
worst_status=scoring.STATUS_INFO,
2216-
full_score=scoring.TLS_KEX_RSA_PKCS_GOOD,
2217-
model_score_field="key_exchange_rsa_pkcs_score",
2218-
)
2219-
2220-
def save_result(self, status: KexRSAPKCSStatus):
2221-
handlers = {
2222-
KexRSAPKCSStatus.good: self.result_good,
2223-
KexRSAPKCSStatus.bad: self.result_bad,
2224-
KexRSAPKCSStatus.unknown: self.result_unknown,
2225-
}
2226-
return handlers[status]()
2227-
2228-
def result_good(self):
2229-
self._status(STATUS_SUCCESS)
2230-
self.verdict = "detail mail tls key-exchange-rsa-pkcs verdict good"
2231-
self.tech_data = "detail tech data good"
2232-
2233-
def result_bad(self):
2234-
self._status(STATUS_FAIL)
2235-
self.verdict = "detail mail tls key-exchange-rsa-pkcs verdict bad"
2236-
self.tech_data = "detail tech data insufficient"
2237-
2238-
def result_unknown(self):
2239-
self._status(STATUS_INFO)
2240-
self.verdict = "detail mail tls key-exchange-rsa-pkcs verdict unknown"
2241-
self.tech_data = "detail tech data not-applicable"
2242-
2243-
22442170
class MailTLSExtendedMasterSecret(Subtest):
22452171
def __init__(self):
22462172
super().__init__(

‎checks/migrations/0020_domaintesttls_extended_master_secret_and_more.py‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,4 @@ class Migration(migrations.Migration):
2525
name="extended_master_secret_score",
2626
field=models.IntegerField(null=True),
2727
),
28-
migrations.AddField(
29-
model_name="domaintesttls",
30-
name="key_exchange_rsa_pkcs",
31-
field=enumfields.fields.EnumField(default=2, enum=checks.models.KexRSAPKCSStatus, max_length=10),
32-
),
33-
migrations.AddField(
34-
model_name="domaintesttls",
35-
name="key_exchange_rsa_pkcs_score",
36-
field=models.IntegerField(null=True),
37-
),
3828
]

‎checks/models.py‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -101,12 +101,6 @@ class ZeroRttStatus(Enum):
101101
na = 2
102102

103103

104-
class KexRSAPKCSStatus(Enum):
105-
bad = 0
106-
good = 1
107-
unknown = 2
108-
109-
110104
class KexHashFuncStatus(Enum):
111105
bad = 0
112106
good = 1
@@ -551,9 +545,6 @@ class DomainTestTls(BaseTestModel):
551545
kex_hash_func_score = models.IntegerField(null=True)
552546
kex_hash_func_bad_hash = models.CharField(max_length=255, null=True, default=None)
553547

554-
key_exchange_rsa_pkcs = EnumField(KexRSAPKCSStatus, default=KexRSAPKCSStatus.unknown)
555-
key_exchange_rsa_pkcs_score = models.IntegerField(null=True)
556-
557548
extended_master_secret = EnumField(TLSExtendedMasterSecretStatus, default=TLSExtendedMasterSecretStatus.unknown)
558549
extended_master_secret_score = models.IntegerField(null=True)
559550

@@ -635,8 +626,6 @@ def __dir__(self):
635626
"ocsp_stapling_score",
636627
"kex_hash_func",
637628
"kex_hash_func_score",
638-
"key_exchange_rsa_pkcs",
639-
"key_exchange_rsa_pkcs_score",
640629
"extended_master_secret",
641630
"extended_master_secret_score",
642631
"forced_https",
@@ -684,7 +673,6 @@ def get_web_api_details(self):
684673
"zero_rtt": self.zero_rtt.name,
685674
"ocsp_stapling": self.ocsp_stapling.name,
686675
"kex_hash_func": self.kex_hash_func.name,
687-
"key_exchange_rsa_pkcs": self.key_exchange_rsa_pkcs.name,
688676
"extended_master_secret": self.extended_master_secret.name,
689677
"https_redirect": self.forced_https.name,
690678
"http_compression": self.http_compression_enabled,
@@ -721,7 +709,6 @@ def get_mail_api_details(self):
721709
"client_reneg": self.client_reneg.name if self.client_reneg else None,
722710
"zero_rtt": self.zero_rtt.name,
723711
"kex_hash_func": self.kex_hash_func.name,
724-
"key_exchange_rsa_pkcs": self.key_exchange_rsa_pkcs.name,
725712
"extended_master_secret": self.extended_master_secret.name,
726713
"cert_chain": self.cert_chain,
727714
"cert_trusted": self.cert_trusted,

‎checks/scoring.py‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -196,11 +196,6 @@
196196
WEB_TLS_OCSP_STAPLING_BAD = NO_POINTS
197197
WEB_TLS_OCSP_STAPLING_WORST_STATUS = STATUS_NOTICE
198198

199-
TLS_KEX_RSA_PKCS_GOOD = FULL_WEIGHT_POINTS
200-
TLS_KEX_RSA_PKCS_OK = FULL_WEIGHT_POINTS
201-
TLS_KEX_RSA_PKCS_BAD = NO_POINTS
202-
TLS_KEX_RSA_PKCS_WORST_STATUS = STATUS_NOTICE
203-
204199
WEB_TLS_KEX_HASH_FUNC_GOOD = FULL_WEIGHT_POINTS
205200
WEB_TLS_KEX_HASH_FUNC_OK = FULL_WEIGHT_POINTS
206201
WEB_TLS_KEX_HASH_FUNC_BAD = NO_POINTS

‎checks/tasks/tls/evaluation.py‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020
KexHashFuncStatus,
2121
CipherOrderStatus,
2222
OcspStatus,
23-
KexRSAPKCSStatus,
2423
TLSClientInitiatedRenegotiationStatus,
2524
TLSExtendedMasterSecretStatus,
2625
)
@@ -312,17 +311,6 @@ def score_client_initiated_renegotiation(self) -> scoring.Score:
312311
return scores[self.status_client_initiated_renegotiation]
313312

314313

315-
@dataclass(frozen=True)
316-
class KeyExchangeRSAPKCSFunctionEvaluation:
317-
"""
318-
Results of support for PKCS padding for RSA per NCSC 3.3.2.1.
319-
NCSC table 5
320-
"""
321-
322-
status: KexRSAPKCSStatus
323-
score: scoring.Score
324-
325-
326314
@dataclass(frozen=True)
327315
class KeyExchangeHashFunctionEvaluation:
328316
"""

‎checks/tasks/tls/scans.py‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@
6060
ZeroRttStatus,
6161
KexHashFuncStatus,
6262
CipherOrderStatus,
63-
KexRSAPKCSStatus,
6463
)
6564
from checks.resolver import dns_resolve_tlsa, DNSSECStatus, dns_resolve_a
6665
from checks.tasks.tls import TLSException
@@ -71,7 +70,6 @@
7170
KeyExchangeHashFunctionEvaluation,
7271
TLSCipherOrderEvaluation,
7372
TLSOCSPEvaluation,
74-
KeyExchangeRSAPKCSFunctionEvaluation,
7573
TLSRenegotiationEvaluation,
7674
TLSExtendedMasterSecretEvaluation,
7775
)
@@ -85,7 +83,6 @@
8583
CERT_RSA_MIN_PHASE_OUT_KEY_SIZE,
8684
SIGNATURE_ALGORITHMS_BAD_HASH,
8785
SIGNATURE_ALGORITHMS_PHASE_OUT_HASH,
88-
SIGNATURE_ALGORITHMS_RSA_PKCS,
8986
)
9087
from internetnl import log
9188

@@ -642,7 +639,6 @@ def check_mail_tls(
642639
prots_accepted,
643640
cipher_evaluation,
644641
)
645-
key_exchange_rsa_pkcs_evaluation = test_key_exchange_rsa_pkcs(server_conn_info)
646642
key_exchange_hash_evaluation = test_key_exchange_hash(server_conn_info)
647643

648644
session_reneg_result = result.scan_result.session_renegotiation.result
@@ -706,8 +702,6 @@ def check_mail_tls(
706702
and result.scan_result.tls_1_3_early_data.result.supports_early_data
707703
else scoring.WEB_TLS_ZERO_RTT_GOOD
708704
),
709-
key_exchange_rsa_pkcs=key_exchange_rsa_pkcs_evaluation.status,
710-
key_exchange_rsa_pkcs_score=key_exchange_rsa_pkcs_evaluation.score,
711705
kex_hash_func=key_exchange_hash_evaluation.status,
712706
kex_hash_func_score=key_exchange_hash_evaluation.score,
713707
kex_hash_func_bad_hash=key_exchange_hash_evaluation.found_hash,
@@ -782,7 +776,6 @@ def check_web_tls(url, af_ip_pair=None, *args, **kwargs):
782776
supported_tls_versions,
783777
cipher_evaluation,
784778
)
785-
key_exchange_rsa_pkcs_evaluation = test_key_exchange_rsa_pkcs(server_conn_info)
786779
key_exchange_hash_evaluation = test_key_exchange_hash(server_conn_info)
787780
session_reneg_result = result.scan_result.session_renegotiation.result
788781
if session_reneg_result is not None:
@@ -844,8 +837,6 @@ def check_web_tls(url, af_ip_pair=None, *args, **kwargs):
844837
),
845838
ocsp_stapling=ocsp_evaluation.status,
846839
ocsp_stapling_score=ocsp_evaluation.score,
847-
key_exchange_rsa_pkcs=key_exchange_rsa_pkcs_evaluation.status,
848-
key_exchange_rsa_pkcs_score=key_exchange_rsa_pkcs_evaluation.score,
849840
kex_hash_func=key_exchange_hash_evaluation.status,
850841
kex_hash_func_score=key_exchange_hash_evaluation.score,
851842
kex_hash_func_bad_hash=key_exchange_hash_evaluation.found_hash,
@@ -910,27 +901,6 @@ def raise_sslyze_errors(result: ServerScanResult) -> None:
910901
raise TLSException(str(last_error_trace))
911902

912903

913-
def test_key_exchange_rsa_pkcs(
914-
server_connectivity_info: ServerConnectivityInfo,
915-
) -> KeyExchangeRSAPKCSFunctionEvaluation:
916-
"""
917-
Test key exchange for RSA PKCS support per NCSC 3.3.2.1.
918-
See also RFC8446 1.3 and 4.2.3, RFC 5246 7.4.1.4.1.
919-
"""
920-
rsa_pkcs_result = _test_connection_with_limited_sigalgs(server_connectivity_info, SIGNATURE_ALGORITHMS_RSA_PKCS)
921-
if rsa_pkcs_result:
922-
log.info(f"RSA-PKCS key exchange check: negotiated bad sigalg ({rsa_pkcs_result})")
923-
return KeyExchangeRSAPKCSFunctionEvaluation(
924-
status=KexRSAPKCSStatus.bad,
925-
score=scoring.TLS_KEX_RSA_PKCS_BAD,
926-
)
927-
928-
return KeyExchangeRSAPKCSFunctionEvaluation(
929-
status=KexRSAPKCSStatus.good,
930-
score=scoring.TLS_KEX_RSA_PKCS_GOOD,
931-
)
932-
933-
934904
def test_key_exchange_hash(
935905
server_connectivity_info: ServerConnectivityInfo,
936906
) -> KeyExchangeHashFunctionEvaluation:

‎checks/tasks/tls/tasks_reports.py‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -275,8 +275,6 @@ def save_results(model, results, addr, domain, category):
275275
model.ocsp_stapling_score = result.get("ocsp_stapling_score")
276276
model.kex_hash_func = result.get("kex_hash_func")
277277
model.kex_hash_func_score = result.get("kex_hash_func_score")
278-
model.key_exchange_rsa_pkcs = result.get("key_exchange_rsa_pkcs")
279-
model.key_exchange_rsa_pkcs_score = result.get("key_exchange_rsa_pkcs_score")
280278
model.kex_hash_func_bad_hash = result.get("kex_hash_func_bad_hash")
281279
model.extended_master_secret = result.get("extended_master_secret")
282280
model.extended_master_secret_score = result.get("extended_master_secret_score")
@@ -355,8 +353,6 @@ def save_results(model, results, addr, domain, category):
355353
# model.ocsp_stapling_score = result.get("ocsp_stapling_score")
356354
model.kex_hash_func = result.get("kex_hash_func")
357355
model.kex_hash_func_score = result.get("kex_hash_func_score")
358-
model.key_exchange_rsa_pkcs = result.get("key_exchange_rsa_pkcs")
359-
model.key_exchange_rsa_pkcs_score = result.get("key_exchange_rsa_pkcs_score")
360356
model.kex_hash_func_bad_hash = result.get("kex_hash_func_bad_hash")
361357
model.extended_master_secret = result.get("extended_master_secret")
362358
model.extended_master_secret_score = result.get("extended_master_secret_score")
@@ -584,7 +580,6 @@ def annotate_and_combine_all(good_items, sufficient_items, bad_items, phaseout_i
584580
elif dttls.kex_hash_func == KexHashFuncStatus.phase_out:
585581
category.subtests["kex_hash_func"].result_phase_out(dttls.kex_hash_func_bad_hash)
586582

587-
category.subtests["key_exchange_rsa_pkcs"].save_result(dttls.key_exchange_rsa_pkcs)
588583
category.subtests["extended_master_secret"].save_result(dttls.extended_master_secret)
589584

590585
elif isinstance(category, categories.MailTls):
@@ -749,7 +744,6 @@ def annotate_and_combine_all(good_items, sufficient_items, bad_items, phaseout_i
749744
elif dttls.kex_hash_func == KexHashFuncStatus.phase_out:
750745
category.subtests["kex_hash_func"].result_phase_out(dttls.kex_hash_func_bad_hash)
751746

752-
category.subtests["key_exchange_rsa_pkcs"].save_result(dttls.key_exchange_rsa_pkcs)
753747
category.subtests["extended_master_secret"].save_result(dttls.extended_master_secret)
754748

755749
dttls.report = category.gen_report()

‎checks/tasks/tls/tls_constants.py‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -133,16 +133,6 @@
133133
(OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA),
134134
(OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.DSA),
135135
]
136-
# NCSC 3.3.2.1: RSA PKCS must not be used.
137-
# Failing these algs means the server has no RSA or RSA in PSS only, either is fine.
138-
SIGNATURE_ALGORITHMS_RSA_PKCS = [
139-
# (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.RSA),
140-
(OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.RSA),
141-
(OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA),
142-
(OpenSslDigestNidEnum.SHA512, OpenSslEvpPkeyEnum.RSA),
143-
(OpenSslDigestNidEnum.SHA384, OpenSslEvpPkeyEnum.RSA),
144-
(OpenSslDigestNidEnum.SHA256, OpenSslEvpPkeyEnum.RSA),
145-
]
146136

147137
# Mail servers with an increased connection limit,
148138
# matched by substring matching on their hostname.

‎interface/batch/openapi.yaml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -689,14 +689,6 @@ components:
689689
* `not_allowed` - not allowed by server.
690690
* `allowed_with_low_limit` - allowed by server, but with a sufficiently low limit (<10).
691691
* `allowed_with_too_high_limit` - allowed by server, with a limit that is too high (>=10).
692-
kex_rsa_pkcs:
693-
type: string
694-
enumClass: KexRSAPKCSStatus
695-
description: |
696-
RSA PKCS#1 v1.5 support:
697-
* `good` - server does not support RSA PKCS#1 v1.5 padding.
698-
* `bad` - server supports RSA PKCS#1 v1.5 padding.
699-
* `unknown` - support could not be determined or test ran before this feature was added.
700692
kex_hash_func:
701693
type: string
702694
enumClass: KexHashFuncStatus

‎interface/templates/domain-results.html‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ <h1>
4242
{% include "details-test-item.html" with testitem=details.tls_cipher_order %}
4343
{% include "details-test-item.html" with testitem=details.fs_params %}
4444
{% include "details-test-item.html" with testitem=details.kex_hash_func %}
45-
{% include "details-test-item.html" with testitem=details.key_exchange_rsa_pkcs %}
4645
{% include "details-test-item.html" with testitem=details.tls_compression %}
4746
{% include "details-test-item.html" with testitem=details.renegotiation_secure %}
4847
{% include "details-test-item.html" with testitem=details.renegotiation_client %}

0 commit comments

Comments
 (0)