Bug: Incorrect IKEv2 Digital Signature by FortiClient 7.4.4/7.4.5

hi,

maybe it helps, https://community.fortinet.com/t5/FortiGate/Technical-Tip-Understanding-signature-verification-failed-errors/ta-p/254874 

Today I installed the latest FortiClient Release v7.4.5 but unfortunately the IKEv2 Digital Signature bug persists as the following IKE_AUTH request parsing of the AUTH payload
for an ecdsa-with-sha256 Digital Signature shows:

2F                Next Payload: 47 - CP
00                C/Reserved
0058              Length: 88 Octets = 8 + 16 + 64 Octets (2*256 Bits)
0E                Auth Method: 14 - Digital Signature (RFC 7427)
000000            Reserved
0F                ASN.1 Length: 15 Octets
30 0D             ASN.1 Sequence: 13 Octets
   06 09          ASN.1 OID: 9 Octets
2A 86 48 86 F7 0D 01 01 0C : sha384WithRSAEncryption (wrong)
   05 00          ASN.1 NULL
9A99C92FEBE71ACC06C5CA110584EE60BB8F005400664C6C604AFB1DE2AF9B60
242860FF498AFEEED6BD6B044913BC11F1E761A1BB93B8D1A27BF93D4809F6EE

The correct ASN.1 Algorithm Identifier encoding according to RFC 7427 is:
0C                ASN.1 Length: 12 Octets
30 0A             ASN.1 Sequence: 10 Octets
   06 08          ASN.1 OID: 8 Octets
2A 86 48 CE 3D 04 03 02 : ecdsa-with-sha256

A slightly different different error occurs with an 3072 bit RSA Digital Signature.
The Algorithm Identifier could now be correct but the signature verification still fails:

2F                Next Payload: 47 - CP
00                C/Reserved
0198              Length: 408 Octets = 8 + 16 + 384 Octets (3072 Bits)
0E                Auth Method: 14 - Digital Signature (RFC 7427)
000000            Reserved
0F                ASN.1 Length: 15 Octets
30 0D             ASN.1 Sequence: 13 Octets
   06 09          ASN.1 OID: 9 Octets
2A 86 48 86 F7 0D 01 01 0C : sha384WithRSAEncryption
   05 00          ASN.1 NULL (no parameters)
3498BF31CDB5D249FCEBDAF2FF2312987EE2030D4B8E4EE9452AF51BC6299906
90FFD4D998E0DD6B531C5EE780263B2670C363D3996F84E2C71CEDE137428C23
A3D87A699527C4E47A1BE891DF402308E5BC2A54A36E6FDD725A5485E33BBFA7
45F631E700B7AB9C75257A66F01586D45525E42BB1FBCCE8D9EFEBD9F87A975D
4F9DDC680423554872238D42712B8E9F3E7245ED31BD3112FCB7E270DF72F211
B6AC38B2E04FBEF915498A6F4789FDC0AE68EC3CD56285BA48604F0B339B97F7
CEFDF549A9410293EE4331200BCE3F9BA9367C99FB3B8C6D136E707FCEC2AFB3
3F9FD5220C90DEB441D0BAAC0B4F8778675F097482BE408750230B3FCB2E3F0C
FCA129FDF8D664A0346D194AA4184483DED441F0ED50D9F1FB09A22AB0896611
7BBDAE5EBDF0AC895632E011F3BD363480F927C1209D0A18D17416DCB87DA411
4C88DBCA151A8573975030CF3EC697EC92ED49DA15897EB546F38C4AA2E7CF80
F55A2236B5F26C8A8AABACD836E966DE013FA1D723803CCB207C1F90F036E018

It might be that instead of the announced sha384WithRSAEncryption a different

RSA signature algorithm was used.

So there is still quite some bug fixing to be done:

Depending on the actual signature scheme selected by the FortiClient for a

given private key type, the correct ASN.1 Algorithm Identifier according to

RFC 7427 must be implemented.

An essential element of the IKEv2 Digital Signature authentication as defined by RFC 4724 is the SIGNATURE_HASH_ALGORITHMS notification exchanged between the IPsec peers that defines which signature hash algorithms can be used. On the FortiGate side the following options enable the use of the IKEv2 Digital Signature authentication payload and define the supported signature hash algorithms: 

config vpn ipsec phase1-interface
  edit "IPSec-Client"
    ...
    set authmethod signature
    set digital-signature-auth enable
    set signature-hash-alg sha2-256 sha2-384
    set rsa-signature-format pss
    set certificate "FW_CERT"
    set peer "remote-client"
    ...
  next
end

The FortiGate debug log of the IKE_SA_INIT request received from the FortiClient shows the supported signature hash algorithms:

ike V=root:0:IPSec-Client:1: processing notify type SIGNATURE_HASH_ALGORITHMS
ike V=root:0:IPSec-Client:1: hash algorithm 2 (sha2-256)
ike V=root:0:IPSec-Client:1: hash algorithm 3 (sha2-384)
ike V=root:0:IPSec-Client:1: hash algorithm 4 (sha2-512)

and the selection done by the FortiGate according to its configuration:

ike V=root:0:IPSec-Client:1: matched hash algorithm 2 (sha2-256)
ike V=root:0:IPSec-Client:1: matched hash algorithm 3 (sha2-384)

This selection is sent back to the FortiClient in the IKE_SA_INIT response.
Thus it is very surprising that the FortiClient generates a sha-1 based signature

in the 3072 bit RSA use case shown in the previous post that clearly violates the
established agreement.

Apparently this bug has been identified by FortiNet and is going to be fixed with release v7.4.6 of the FortiClient.

Unfortunately the bug hasn’t been fixed yet with release v7.4.6. The wrong Digital Signature encoding is the same as with the previous release v7.4.5.