kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Set PBKDF2 limit in PKCS#12 to 100M.

Browse Source 
The previous limit was |UINT_MAX|. Windows limits to 600K, but that's
already causing issues. This seems like a balance between being
completely crazy and still large enough not to have to worry for a long
time. It's still probably too large for backend systems wanting to
process arbitrary PKCS#12, but I don't think any fixed value will
satisfy all desires.

Change-Id: I01a3f78d5f2df086f8dbc0e8bacfb95153738f55
Reviewed-on: https://boringssl-review.googlesource.com/30424
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
Adam Langley 2018-08-08 09:25:36 -07:00 committed by CQ bot account: commit-bot@chromium.org
parent 2bcb315138
commit c81965a8ad
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/pkcs8/pkcs8_x509.c
View File

@ -672,7 +672,12 @@ int PKCS12_get_key_and_certs(EVP_PKEY **out_key, STACK_OF(X509) *out_certs,
#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
static const uint64_t kIterationsLimit = 1024;
#else
static const uint64_t kIterationsLimit = UINT_MAX;
// Windows imposes a limit of 600K. Mozilla say: “so them increasing
// maximum to something like 100M or 1G (to have few decades of breathing
// room) would be very welcome”[1]. So here we set the limit to 100M.
//
// [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1436873#c14
static const uint64_t kIterationsLimit = 100 * 1000000;
#endif
// The iteration count is optional and the default is one.