Skip to content

Insecure random number generation in keypair

High severity GitHub Reviewed Published Oct 11, 2021 in juliangruber/keypair • Updated Feb 1, 2023

Package

npm keypair (npm)

Affected versions

< 1.0.4

Patched versions

1.0.4

Description

Description and Impact

A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recommend replacing any RSA keys that were generated using keypair version 1.0.3 or earlier.

Fix

  • The bug in the pseudo-random number generator is fixed in commit 9596418.
  • If the crypto module is available, it is used instead of the pseudo-random number generator. Also fixed in 9596418

Additional Details

The specific line with the flaw is:

b.putByte(String.fromCharCode(next & 0xFF))

The definition of putByte is

util.ByteBuffer.prototype.putByte = function(b) {
  this.data += String.fromCharCode(b);
};

Simplified, this is String.fromCharCode(String.fromCharCode(next & 0xFF)). This results in most of the buffer containing zeros. An example generated buffer:

(Note: truncated for brevity)

\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x04\x00\x00\x00....\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00

Since it is masking with 0xFF, approximately 97% of the bytes are converted to zeros. The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion.

Credit

This issue was reported to GitHub Security Lab by Ross Wheeler of Axosoft. It was discovered by Axosoft engineer Dan Suceava, who noticed that keypair was regularly generating duplicate RSA keys. GitHub security engineer @vcsjones (Kevin Jones) independently investigated the problem and identified the cause and source code location of the bug.

References

@juliangruber juliangruber published to juliangruber/keypair Oct 11, 2021
Reviewed Oct 11, 2021
Published to the GitHub Advisory Database Oct 11, 2021
Published by the National Vulnerability Database Oct 11, 2021
Last updated Feb 1, 2023

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS score

0.339%
(72nd percentile)

Weaknesses

CVE ID

CVE-2021-41117

GHSA ID

GHSA-3f99-hvg4-qjwj

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.