Openssl: CMS_decrypt returns success even if CEK decryption failed (not RSA)

[Mironenko]

In 146b52edd122f55e2b2bfeb486dae8dbe96f739e there was introduced a protection against MMA attack (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding), but it looks like the behavior introduced affects not only RSA mechanism, but also any mechanism that uses KeyTransRecipientInfo structure to store RecipientInfo, containing encrypted CEK and associated data. One of such mechanisms is GOST34.10-2001/2012 (see https://tools.ietf.org/html/rfc4490#section-4.2 and https://www.cryptopro.ru/sites/default/files/products/tls/tk26cms.pdf (russian)), which is implemented through separate engine (https://github.com/gost-engine/engine). AFAIK GOST34.10 is not vulnerable to MMA attack (moreover, inside of KeyTransRecipientInfo there is a checksum of CEK to check that it is correctly decrypted -- see https://tools.ietf.org/html/rfc4357#section-6.1) and it would be nice if CMS_decrypt returned an error on unsuccessful decryption in this case.

I would like to propose narrowing the protection against MMA attack to RSA decryption only.

[slontis]

Another option would be to just include a header in your content data that contains some form of identifier. On decryption it should then be easy to tell if the content is correct.

This code was added in 2012 - so it has been there for quite some time :)