RUSTSEC-2023-0071 reviewed exception

Runtime reachability

The native broker resolves rsa 0.10.0-rc.18 only through krabka-security 0.7.0 -> krabka-sspi 0.23.0; krabka-sspi also reaches the same RSA crate through picky 7.0.0-rc.26. The RSA crate is therefore present in production binaries and cargo audit correctly reports it.

The advisory applies to attacker-observable timing of RSA PKCS#1 v1.5 private key decryption. The broker’s SSPI integration does not accept an RSA key or certificate. Its GSSAPI server loads AES-256 service keys from a keytab and calls the Kerberos acceptor; its inter-broker client loads an AES-256 principal key and calls the Kerberos initiator. RSA private-key operations belong to the SSPI PKINIT, PKU2U, smart-card, and certificate-key surfaces, none of which the broker constructs or exposes. Kafka network tokens can reach Kerberos ticket processing, but cannot select those other SSPI packages or supply an RSA private key. Consequently the vulnerable decryption oracle is not reachable in any currently supported broker authentication configuration.

Exception and regression boundary

krabka-security and krabka-client-core put SSPI behind an opt-in gssapi feature, so a default build of either compiles no rsa. The broker turns the feature on in crates/broker/Cargo.toml, because it serves GSSAPI and dials other brokers with it, so the broker binary still contains rsa and the exception stays. Removing RSA here would remove supported GSSAPI authentication or require a large fork of a sibling crate. Until upstream can isolate the dependency, the security workflow passes exactly --ignore RUSTSEC-2023-0071 to cargo audit, which ignores no other advisory, and deny.toml carries the same entry for cargo deny.

aspect check-rustsec-2023-0071 (.aspect/check_rustsec_2023_0071.axl) pins the reviewed versions of rsa, picky, krabka-sspi and krabka-security, resolves the graph with every feature enabled, and asserts the complete normal reverse edge at the vulnerable boundary: rsa <- {krabka-sspi, picky}, picky <- krabka-sspi, and krabka-sspi <- krabka-security. Any version or parent change fails CI and requires a fresh reachability review. Removal of any package also fails so the exception must be removed rather than becoming stale.

Residual risk and downstream coordination

The conclusion depends on the reviewed SSPI and security implementations, not on a constant-time guarantee in rsa. A future path that accepts certificate credentials, enables PKINIT/PKU2U or smart cards, or adds another RSA parent must not reuse this exception.

krabka-protocol made its GSSAPI dependency optional (krabka-protocol#71), and its docs/rustsec-2023-0071.md covers the client initiator as well. Coordinate with krabka-sspi to expose a Kerberos-only feature that excludes RSA, PKINIT, PKU2U, smart-card, and certificate-private-key code. Remove the audit exception and this version-pin check as soon as an RSA-free feature or patched upstream release is available.