Hardening: refuse a JSON "dir" JWE without protected header and "aad", whose content can be an A*GCMKW encrypted key

Aperta
  • Qualcosa non va?
#760 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
php
Ambito
backend-api-design, security

Direzione di ricerca

Read the decrypter and builder paths for JSON JWE handling, then trace how protected headers and aad determine content authentication data for dir. Check the existing tests for JSON serialization and decryption. Done means the decrypter rejects the described empty-AAD shape, the builder no longer emits it, and documentation recommends setting alg on keys shared across algorithms.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement
Version(s) affected

All released versions (3.4.x, 4.0.x, 4.1.x, 4.2.x), and the 4.3.x and 5.0.x branches.

Description

AES-GCM key wrapping (A128GCMKW, A192GCMKW, A256GCMKW) encrypts the CEK with AES-GCM under the key and an empty AAD. In the JSON serializations, a JWE may carry alg and enc outside the protected header. When it has neither a protected header nor an aad member, the AAD of its content is empty too, and with dir the content is then encrypted by the same computation as a GCM key wrap.

A decrypter that registers dir, an AGCMKW algorithm and the AGCM algorithm of the same size, and holds the key-wrapping key without an alg parameter, therefore accepts the encrypted key of an A*GCMKW token presented as the content of a dir JWE, and returns the CEK of that token as payload. Nothing is gained unless the application reveals decrypted payloads to the sender. If it does, the CEK opens the original token and allows new content under its encrypted key. Conversely, a JSON dir JWE issued without a protected header is a valid GCM key wrap of its plaintext.

This is a property of the JSON serializations rather than of this library alone: other implementations behave the same when they are given the raw key bytes (checked with panva/jose 6.2.2). Compact JWEs, and therefore JWTs, cannot take this shape.

Mitigations available today:

  • an alg parameter on every key (the key analyzer already reports keys without it);
  • an AlgorithmChecker that reads the protected header only;
  • not registering dir next to key wrapping algorithms in the same decrypter.
Possible Solution
  • The decrypter refuses a dir JWE whose content AAD is empty (no protected header and no aad), and the builder no longer produces one. This refuses a token shape the JSON serializations allow, so 4.3.0 with an upgrade note.
  • Documentation: recommend alg on the keys of a key set shared by several algorithms.

Related: #761 (key_ops does not tell content decryption from key unwrapping).

Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-35BMRM17).

Lingua principale
PHP
Stelle
954
Fork
119
Merge medio
48m
PR unite (30g)
17

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di web-token/jwt-framework

Tutte le issue di web-token/jwt-framework

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.