Affects Bouncy Castle for Java before 1.85. PBES2 decryptor builders pass the scrypt cost parameters and PBKDF2 iteration count from an attacker-supplied EncryptedPrivateKeyInfo, PKCS#12 or CMS structure straight into key derivation, and the same pattern appears in the OpenSSL PKCS#8 builder, CMS password recipients and PKCS12PfxPdu MAC verification. Because derivation runs before any integrity check, a small input can force gigabytes of scrypt memory or up to 2^31 HMAC iterations, …
Affects Bouncy Castle for Java before 1.85. PKCS12KeyStoreSpi and PKCS12PBMAC1KeyStoreSpi derived integrity-MAC and bag-decryption keys using iteration counts taken from the keystore file with no ceiling. A file of a few hundred bytes declaring a count near 2^31 occupies the loading thread in key derivation before any password or integrity check can fail. Counts are now validated and capped at five million by default, adjustable through org.bouncycastle.pkcs12.max_it_count.
Affects Bouncy Castle for Java before 1.85. PKMACBuilder's default constructor leaves the iteration ceiling disabled, so when a CA or RA verifies a password-MAC protected CMP or CRMF message the iteration count is taken from the attacker's PBMParameter and drives the digest loop unbounded. A count near 2^31 occupies a server thread for hours, and a small number of requests exhausts the thread pool. The same unbounded pattern applies to …
Affects Bouncy Castle for Java before 1.85. CMSSignedData.verifySignatures() iterates the signer set and returns true once the loop completes, without requiring that any signer be present. RFC 5652 allows a degenerate SignedData with an empty signerInfos set, and neither the ASN.1 layer nor SignerInformationStore rejects one. An attacker can submit a CMS or PKCS#7 blob carrying arbitrary content and no signers; applications treating the return value as proof of authenticity …
Affects Bouncy Castle for Java before 1.85. CMS AuthEnvelopedData recipients applied no lower bound to the AEAD tag length declared in the content-encryption AlgorithmIdentifier, a field the tag itself does not cover. Re-encoding a message to declare a truncated ICV, as low as 32 bits for the CCM family, weakens forgery resistance proportionally while decryption still succeeds. Recipients now accept a minimum tag size and reject shorter declarations before returning …
Affects Bouncy Castle for Java before 1.85. RecipientInformation.getContentStream() digests the content separately while the MAC covers only the DER-encoded authenticated attributes, and the library never compares the computed digest against the messageDigest attribute that RFC 5652 requires. The documented usage pattern compares only the two MAC values, so callers following it never bind content to the MAC. An attacker can replace the encapsulated content while leaving the attributes and MAC …
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules). PKIX draft CompositeVerifier accepts empty signature sequence as valid. This issue affects BC-JAVA: from 1.49 before 1.84.