Go 1.15: broken PBSE2 KDF #26

eclipseo · 2020-08-23T05:57:23Z

Since Go 1.15 beta 1, the test suite fails with these errors:

Testing    in: /builddir/build/BUILD/jose2go-1.3/_build/src
         PATH: /builddir/build/BUILD/jose2go-1.3/_build/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/sbin
       GOPATH: /builddir/build/BUILD/jose2go-1.3/_build:/usr/share/gocode
  GO111MODULE: off
      command: go test -buildmode pie -compiler gc -ldflags " -X github.com/dvsekhvalnov/jose2go/version=1.3 -extldflags '-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld '"
      testing: github.com/dvsekhvalnov/jose2go
github.com/dvsekhvalnov/jose2go
invalid sign 'alg' header err= jwt.Decode(): required 'alg' header is missing or of invalid type
missing sign 'alg' header err= jwt.Decode(): required 'alg' header is missing or of invalid type
two phased err= Test error
invalid encrypt 'alg' header err= jwt.Decode(): required 'alg' header is missing or of invalid type
invalid encrypt 'enc' header err= jwt.Decode(): required 'enc' header is missing or of invalid type
missing encrypt 'alg' header err= jwt.Decode(): required 'alg' header is missing or of invalid type
missing encrypt 'enc' header err= jwt.Decode(): required 'enc' header is missing or of invalid type
----------------------------------------------------------------------
FAIL: jose_test.go:1588: TestSuite.TestDecrypt_PBSE2_HS256_A128KW_A128CBC_HS256
jose_test.go:1596:
    //then
    c.Assert(err, IsNil)
... value *errors.errorString = &errors.errorString{s:"aes.KeyUnwrap(): integrity check failed."} ("aes.KeyUnwrap(): integrity check failed.")
----------------------------------------------------------------------
FAIL: jose_test.go:1600: TestSuite.TestDecrypt_PBSE2_HS384_A192KW_A192CBC_HS384
jose_test.go:1608:
    //then
    c.Assert(err, IsNil)
... value *errors.errorString = &errors.errorString{s:"aes.KeyUnwrap(): integrity check failed."} ("aes.KeyUnwrap(): integrity check failed.")
----------------------------------------------------------------------
FAIL: jose_test.go:1612: TestSuite.TestDecrypt_PBSE2_HS512_A256KW_A256CBC_HS512
jose_test.go:1620:
    //then
    c.Assert(err, IsNil)
... value *errors.errorString = &errors.errorString{s:"aes.KeyUnwrap(): integrity check failed."} ("aes.KeyUnwrap(): integrity check failed.")

Any chance that you take a look at what causing these issues?

The text was updated successfully, but these errors were encountered:

dvsekhvalnov · 2020-08-25T09:48:29Z

Hi @eclipseo ,

thanks for letting me know. I'll take a look. Or if you have PR - it is always welcome too :)

dvsekhvalnov · 2020-08-27T10:57:31Z

Seems to be PBSE2 KDF is badly broken on Go v1.15 probably due to some changes in 'crypto/hash'. Investigating.

That given said on v1.15 all PBSE2 encryption options producing not-compatible tokens. Everything else seems to be fine.

dvsekhvalnov · 2020-08-27T19:26:27Z

Appears to be an issue with new crypto/hmac implementation with respect to .Reset: https://github.com/golang/go/blob/master/src/crypto/hmac/hmac.go#L59

will dig more

dvsekhvalnov · 2020-09-01T11:09:05Z

Fixed in 1.15.

@eclipseo when you have a chance, give it a try? All fixes have been merged to master.

eclipseo · 2020-09-17T22:20:39Z

Hey thanks, works perfectly in Fedora 33 and Rawhide:

The updated version fixed dvsekhvalnov/jose2go#26.

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15.

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15. From: #7397

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15.

Fixes goharbor#14932 Harbor recompiles the notary v0.6.1 with go 1.15 from v2.2.0, which introduces an break change that leads to notary key not found after migration. [Root cause] Notary v0.6.1 consumed an old version dvsekhvalnov/jose2, which is not compatible with go 1.15. [References] dvsekhvalnov/jose2go#26 golang/go#41089 [Resolve] To resolve this issue, we have to roll back go vesrion to v1.14 for notary v0.6.1 binary and keep it until upstream have a patch release to support go 1.15 or above. [Break change] If you're already on Harbor v2.2.0 ~ v2.2.2 and have signed images with notary, you will encouter the same issue after migrate to v2.2.3(or above) or v2.3.1(or above) because of the go version downgrade. We will have a FAQ to help you to resovle this particular scenario. The influence path of the particular case: Harbor v2.1.0(or lower) --> [v2.2.0 ~ v2.2.2] --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.0 --> v2.3.1(or above) The non influence path of the paticular case: Harbor v2.1.0(or lower) --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.1(or above) [Fix in Version] Harbor v2.2.3 or above Harbor v2.3.1 or above [Note] If you're a heavy user of notary, avoid using v2.2.0, v2.2.1, v2.2.2 and v2.3.0, and use the fixed version for instead. Signed-off-by: Wang Yan <[email protected]>

Fixes goharbor#14932 Harbor recompiles the notary v0.6.1 with go 1.15 from v2.2.0, which introduces an break change that leads to notary key not found after migration. [Root cause] Notary v0.6.1 consumed an old version dvsekhvalnov/jose2, which is not compatible with go 1.15. [References] dvsekhvalnov/jose2go#26 golang/go#41089 [Resolve] To resolve this issue, we have to roll back go vesrion to v1.14 for notary v0.6.1 binary and keep it until upstream have a patch release to support go 1.15 or above. [Break change] If you pushed and signed image using Harbor v2.2.0 ~ v2.2.2 and created new repository key in notary, you will encouter the same issue after migrate to v2.2.3(or above) or v2.3.1(or above) because of the go version downgrade. We will have a FAQ to help you to resovle this particular scenario. The influence path of the particular case: Harbor v2.1.0(or lower) --> [v2.2.0 ~ v2.2.2] --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.0 --> v2.3.1(or above) The non influence path of the paticular case: Harbor v2.1.0(or lower) --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.1(or above) [Fix in Version] Harbor v2.2.3 or above Harbor v2.3.1 or above [Note] If you're a heavy user of notary, avoid using v2.2.0, v2.2.1, v2.2.2 and v2.3.0, and use the fixed version for instead. Signed-off-by: Wang Yan <[email protected]>

Fixes #14932 Harbor recompiles the notary v0.6.1 with go 1.15 from v2.2.0, which introduces an break change that leads to notary key not found after migration. [Root cause] Notary v0.6.1 consumed an old version dvsekhvalnov/jose2, which is not compatible with go 1.15. [References] dvsekhvalnov/jose2go#26 golang/go#41089 [Resolve] To resolve this issue, we have to roll back go vesrion to v1.14 for notary v0.6.1 binary and keep it until upstream have a patch release to support go 1.15 or above. [Break change] If you pushed and signed image using Harbor v2.2.0 ~ v2.2.2 and created new repository key in notary, you will encouter the same issue after migrate to v2.2.3(or above) or v2.3.1(or above) because of the go version downgrade. We will have a FAQ to help you to resovle this particular scenario. The influence path of the particular case: Harbor v2.1.0(or lower) --> [v2.2.0 ~ v2.2.2] --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.0 --> v2.3.1(or above) The non influence path of the paticular case: Harbor v2.1.0(or lower) --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.1(or above) [Fix in Version] Harbor v2.2.3 or above Harbor v2.3.1 or above [Note] If you're a heavy user of notary, avoid using v2.2.0, v2.2.1, v2.2.2 and v2.3.0, and use the fixed version for instead. Signed-off-by: Wang Yan <[email protected]>

Fixes goharbor#14932 Harbor recompiles the notary v0.6.1 with go 1.15 from v2.2.0, which introduces an break change that leads to notary key not found after migration. [Root cause] Notary v0.6.1 consumed an old version dvsekhvalnov/jose2, which is not compatible with go 1.15. [References] dvsekhvalnov/jose2go#26 golang/go#41089 [Resolve] To resolve this issue, we have to roll back go vesrion to v1.14 for notary v0.6.1 binary and keep it until upstream have a patch release to support go 1.15 or above. [Break change] If you pushed and signed image using Harbor v2.2.0 ~ v2.2.2 and created new repository key in notary, you will encouter the same issue after migrate to v2.2.3(or above) or v2.3.1(or above) because of the go version downgrade. We will have a FAQ to help you to resovle this particular scenario. The influence path of the particular case: Harbor v2.1.0(or lower) --> [v2.2.0 ~ v2.2.2] --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.0 --> v2.3.1(or above) The non influence path of the paticular case: Harbor v2.1.0(or lower) --> v2.2.3(or above) Harbor v2.1.0(or lower) --> v2.3.1(or above) [Fix in Version] Harbor v2.2.3 or above Harbor v2.3.1 or above [Note] If you're a heavy user of notary, avoid using v2.2.0, v2.2.1, v2.2.2 and v2.3.0, and use the fixed version for instead. Signed-off-by: Wang Yan <[email protected]>

dvsekhvalnov changed the title ~~Not working anymore on Go 1.15~~ Go 1.15: broken PBSE2 KDF Aug 27, 2020

dvsekhvalnov mentioned this issue Aug 28, 2020

crypto/hmac: detect reuse of hash.Hash value golang/go#41089

Closed

dvsekhvalnov closed this as completed Sep 1, 2020

Dominator008 added a commit to celer-network/sgn that referenced this issue Sep 23, 2020

Update jose2go to make SGN work with go1.15

23d41f5

The updated version fixed dvsekhvalnov/jose2go#26.

Dominator008 mentioned this issue Sep 23, 2020

Update jose2go to make SGN work with go1.15 celer-network/sgn#394

Merged

Dominator008 added a commit to celer-network/sgn that referenced this issue Sep 23, 2020

Update jose2go to make SGN work with go1.15

97b5f93

The updated version fixed dvsekhvalnov/jose2go#26.

Dominator008 added a commit to celer-network/sgn that referenced this issue Sep 24, 2020

Update jose2go to make SGN work with go1.15 (#394)

d1515d4

The updated version fixed dvsekhvalnov/jose2go#26.

Dominator008 added a commit to Dominator008/keyring that referenced this issue Sep 25, 2020

Update jose2go to be compatible with go1.15

da36c89

The updated version fixed dvsekhvalnov/jose2go#26.

This was referenced Sep 25, 2020

Update jose2go to be compatible with go1.15 99designs/keyring#75

Merged

Update 99designs/keyring to v1.1.6 for go 1.15 cosmos/cosmos-sdk#7397

Merged

alessio pushed a commit to cosmos/cosmos-sdk that referenced this issue Sep 25, 2020

Update 99designs/keyring to v1.1.6 for go 1.15 (#7397)

7ee0aed

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15.

alessio pushed a commit to cosmos/cosmos-sdk that referenced this issue Sep 25, 2020

Update 99designs/keyring to v1.1.6 for go 1.15

f0945bf

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15. From: #7397

alessio mentioned this issue Sep 25, 2020

Update 99designs/keyring to v1.1.6 for go 1.15 cosmos/cosmos-sdk#7398

Merged

9 tasks

alessio pushed a commit to cosmos/cosmos-sdk that referenced this issue Sep 28, 2020

Update 99designs/keyring to v1.1.6 for go 1.15 (#7398)

a1d18a1

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15. From: #7397

mtibben mentioned this issue Dec 12, 2020

Upgrade from 6.1.0 to 6.2.0 breaks file backend 99designs/aws-vault#700

Closed

daeMOn63 pushed a commit to fetchai/cosmos-sdk that referenced this issue May 5, 2021

Update 99designs/keyring to v1.1.6 for go 1.15 (#7397)

ae318f6

The release contains a fix for dvsekhvalnov/jose2go#26, which is needed for the file keyring backend to work with go 1.15.

reasonerjt mentioned this issue Jun 23, 2021

Harbor Version Upgrade from 2 to 2.2 Causing Key Issue goharbor/harbor#14932

Closed

wy65701436 mentioned this issue Jun 29, 2021

roll back go for notary binary goharbor/harbor#15223

Merged

wy65701436 mentioned this issue Jun 29, 2021

[cherry pick]roll back go for notary binary goharbor/harbor#15224

Merged

wy65701436 mentioned this issue Jun 29, 2021

[cherry pick]roll back go for notary binary goharbor/harbor#15225

Merged

reasonerjt mentioned this issue Jun 29, 2021

Error to decode a key that was persisted after using go1.15 to compile Notary notaryproject/notary#1602

Closed

xinfengliu mentioned this issue Oct 18, 2021

v0.6.1-2 image does not work anymore docker/notary-official-images#25

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Go 1.15: broken PBSE2 KDF #26

Go 1.15: broken PBSE2 KDF #26

eclipseo commented Aug 23, 2020

dvsekhvalnov commented Aug 25, 2020

dvsekhvalnov commented Aug 27, 2020 •

edited

Loading

dvsekhvalnov commented Aug 27, 2020

dvsekhvalnov commented Sep 1, 2020

eclipseo commented Sep 17, 2020

Go 1.15: broken PBSE2 KDF #26

Go 1.15: broken PBSE2 KDF #26

Comments

eclipseo commented Aug 23, 2020

dvsekhvalnov commented Aug 25, 2020

dvsekhvalnov commented Aug 27, 2020 • edited Loading

dvsekhvalnov commented Aug 27, 2020

dvsekhvalnov commented Sep 1, 2020

eclipseo commented Sep 17, 2020

dvsekhvalnov commented Aug 27, 2020 •

edited

Loading