Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New crypto provider via OpenSSL library #5382

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

Cropi
Copy link
Collaborator

@Cropi Cropi commented May 16, 2024

This new ossl crypto provider encapsulates the ability to use log encryption in the omfile module. It provides the same functionality as gcry, additionaly:

  • Algorithm are not hardcoded. We simply provide everything what can be fetched via the EVP_CIPHER_fetch() call. The same applies to the mode parameter.
  • It does not add extra dependency to a new package. Distro maintainers who are already using openssl do not need add anything in particular. By default, if rsyslog is compiled with --enable-openssl, the ossl crypto provider will also be included in both omfile and also rscryutil.
  • Side-channel vulnerability in libgcrypt - the Marvin Attack
    https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html (see the whole thread)
    Some might be worried about other side-channel vulnerabilities against it, like the
    Minerva Attack[1], and the Raccoon Attack[2], given the way they handled one of the oldest, well known, and
    most straightforward side-channel attacks. They did downgrade their threat model as a result of Marvin too: https://gnupg.org/documentation/security.html. I don't see it as a proper way to deal with potential threats.

[1] https://minerva.crocs.fi.muni.cz/
[2] https://raccoon-attack.com/

Default behavior is preserved. I've tested a few different scenarios and the two crypto providers can work in tandem, but I don't suggest to mix them.
In order to put it into action, add cry.provider="ossl" to an omfile action. Generate some syslog messages, and finally use the the rscryutil with --lib=ossl. The only difference if altering the algorithm/mode then you must do it in one step, e.g.:

  • ./tools/rscryutil -k keyfile -l ossl -a AES-256-CBC encryptedfile for ossl
  • ./tools/rscryutil -k keyfile -l gcry -a AES256 -m CBC encryptedfile for gcry

The documentation is currently missing, I will create it if the patch is accepted. Thanks.

The rscryutil tool is fully dependent on the libgcrypt library. We need
to refactor it in case there will ever be a new crypto provider added.
@Cropi Cropi force-pushed the openssl-crypto-provider branch 3 times, most recently from c29cbfd to 76d084e Compare May 16, 2024 09:48
@rgerhards rgerhards self-assigned this May 16, 2024
@rgerhards rgerhards added this to the v8.2406 milestone May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants