enricobuehler
60de506f66
Red-team found the .cargo/audit.toml justification for RUSTSEC-2023-0071 was materially wrong: it claimed "Marvin targets decryption, so the vulnerable path isn't exercised" — but the advisory is a variable-time modexp of the secret exponent, which RSA *signing* (signing_key.sign) also runs. The accept is still correct, for the RIGHT reasons (no decryption/padding oracle; the signed serversecret is host-random not attacker-chosen; signing is operator-PIN-gated; GameStream is off by default and the native QUIC plane uses rustls, not rsa; Moonlight mandates RSA-2048 so the GameStream key can't move off it). Rewrite the rationale accordingly. Also shut the timing-sample amplifier the review surfaced: the pairing session was never marked after phase 3, so a peer past phase 1 could loop phase2/phase3 to harvest many RSA signing-time samples. Sign exactly once per ceremony (reject a repeated serverchallengeresp). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
2.9 KiB
TOML
38 lines
2.9 KiB
TOML
# cargo-audit configuration — consumed by `.gitea/workflows/audit.yml` (`cargo audit`).
|
|
#
|
|
# Silence only advisories that are KNOWN-UNFIXABLE and either not applicable to how we use the crate
|
|
# or an accepted, documented risk. Keep this list TIGHT and justify every entry — an ignore here
|
|
# means the audit job stops flagging it, so the reasoning must hold up.
|
|
#
|
|
# NOTE: `cargo audit` (no `--deny warnings`) fails only on *vulnerabilities*, not on the
|
|
# `unmaintained` warnings (audiopus_sys via opus, paste via utoipa-axum). Both are transitive, at
|
|
# their latest published version with no successor, so there's nothing to bump — left visible on
|
|
# purpose so we keep getting the maintenance signal; they do not fail CI. (rustls-pemfile was dropped
|
|
# 2026-06-29 by removing axum-server's unused tls-rustls feature + moving our own PEM parsing to
|
|
# rustls-pki-types; memmap2's unsoundness was fixed by the 0.9.11 bump.)
|
|
|
|
[advisories]
|
|
ignore = [
|
|
# rsa "Marvin Attack" (RUSTSEC-2023-0071): a timing side-channel in the rsa crate's variable-time
|
|
# modular exponentiation of the SECRET exponent. IMPORTANT — this affects the RSA private-key op in
|
|
# general, INCLUDING signing (m^d mod n), which the host DOES perform (gamestream/pairing.rs
|
|
# `signing_key.sign(&serversecret)`). It is NOT, as an earlier version of this note wrongly claimed,
|
|
# limited to decryption — so "the vulnerable path isn't exercised" is false; signing exercises it.
|
|
# We accept it because the attack is not practically reachable here, NOT because the path is unused:
|
|
# * No RSA decryption / PKCS#1v1.5 padding oracle exists anywhere (every `decrypt` in the tree is
|
|
# AES/AES-GCM), so the classic Bleichenbacher/Marvin chosen-ciphertext oracle is absent.
|
|
# * The only signed message (`serversecret`) is HOST-generated random, never attacker-chosen — so
|
|
# there's no adaptive chosen-input probing (the lever remote RSA-timing key recovery needs); and
|
|
# signing is gated behind the operator-entered pairing PIN, ONE signature per ceremony (a
|
|
# repeated phase-3 is rejected — gamestream/pairing.rs — to deny a passive timing-sample harvester).
|
|
# * GameStream is OFF by default (bare `serve` is native-only); the secure native QUIC plane uses
|
|
# rustls' constant-time backend, NOT the rsa crate. RSA is touched only on the opt-in,
|
|
# trusted-LAN GameStream/Moonlight pairing handshake. Moonlight mandates RSA-2048, so the
|
|
# GameStream identity cannot move to Ed25519/ECDSA (only the native identity could, and it
|
|
# already avoids the rsa crate).
|
|
# There is NO fixed rsa release (the constant-time rewrite is still unreleased upstream). Revisit if:
|
|
# a constant-time rsa ships (then drop this), the host ever signs an attacker-chosen message with
|
|
# this key, or any RSA decryption / key-transport using the private key is added.
|
|
"RUSTSEC-2023-0071",
|
|
]
|