[tor-bugs] #3318 [Tor Client]: Incorrect log message in token_check_object

[Tor Bug Tracker & Wiki]

#3318: Incorrect log message in token_check_object
---------------------------+------------------------------------------------
    Reporter:  rransom     |       Owner:                    
        Type:  defect      |      Status:  needs_review      
    Priority:  trivial     |   Milestone:  Tor: 0.2.2.x-final
   Component:  Tor Client  |     Version:                    
  Resolution:              |    Keywords:  easy              
      Parent:              |      Points:                    
Actualpoints:              |  
---------------------------+------------------------------------------------

Comment(by nickm):

 Replying to [comment:4 rransom]:
 > Replying to [comment:3 nickm]:
 > > Well, if we really care that not all 128-byte keys will really have
 1024 bits of modulus, then fixing the log message alone isn't enough: we
 should fix the check too.
 >
 > I care about ''never'' lying to the user.  We can't check the key size
 in bits because OpenSSL's documentation says it can generate keys shorter
 than 1024 bits when it is told to generate a 1024-bit key.

 Can you point me to the place in the openssl documentation that says this?
 If so, it would seem to be a flaw in openssl that we should work around.
 But I just took a safari through the openssl 1.0.0d RSA_generate_key code,
 and found that the numbers we're using for p and q ultimately come out of
 BN_rand(p, 512, 1, 1), which makes it so that the two most significant
 bits of the output are always 1.  To make sure this isn't a new
 innovation, I checked openssl 0.9.6h, and it was true there too.

 When I ran this patch code, Tor didn't complain about any keys of
 incorrect key length.  Also, I tried writing a quick program to generate
 RSA keys and count their bits: so far it's made ~31k keys without any of
 an unexpected length.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3318#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online