openbsd/src/lib/libcrypto/bn/bn_exp.c, branch OPENBSD_6_8_BASE A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2017-05-02T03:59:45+00:00 use freezero() instead of memset/explicit_bzero + free. Substantially 2017-05-02T03:59:45+00:00 deraadt 2017-05-02T03:59:45+00:00 urn:sha1:5904cc0e04409fde39a97e6580535da34eeb4291 reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck Send the function codes from the error functions to the bit bucket, 2017-01-29T17:49:23+00:00 beck 2017-01-29T17:49:23+00:00 urn:sha1:d1f47bd292f36094480caa49ada36b99a69c59b0 as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@ Split out BN_div and BN_mod into ct and nonct versions for Internal use. 2017-01-21T10:38:29+00:00 beck 2017-01-21T10:38:29+00:00 urn:sha1:55a172a1ed5b0cd8f7de3628fcc2e56df6716d59 ok jsing@ Make explicit _ct and _nonct versions of bn_mod_exp funcitons that 2017-01-21T09:38:59+00:00 beck 2017-01-21T09:38:59+00:00 urn:sha1:a0a595cda97de2b217b0582cfa601ee4c746bfce matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@ /usr/bin/unifdef -D MONT_MUL_MOD -D MONT_EXP_WORD -D RECP_MUL_MOD -m bn_exp.c 2017-01-21T04:34:16+00:00 beck 2017-01-21T04:34:16+00:00 urn:sha1:31dfbaab5a16857bb52fb54f901acd28b7fd7906 with some style cleanup after. no binary change ok jsing@ add constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF. 2016-09-03T17:26:29+00:00 bcook 2016-09-03T17:26:29+00:00 urn:sha1:b4ded23bb909c13a8816bec41389b6a343fba9db Patch based on OpenSSL commit d7a854c055ff22fb7da80c3b0e7cb08d248591d0 "Performance penalty varies from platform to platform, and even key length. For rsa2048 sign it was observed to reach almost 10%." CVE-2016-0702 ok beck@ BN_mod_exp_mont_consttime: check for zero modulus. 2016-09-03T17:21:38+00:00 bcook 2016-09-03T17:21:38+00:00 urn:sha1:a1bddd1baaaf2f6eb4754140425b09a3b301210f Don't dereference d when top is zero. Original patch from OpenSSL commit d46e946d2603c64df6e1e4f9db0c70baaf1c4c03 ok jsing@ BN_mod_exp_mont_consttime: check for zero modulus. 2016-09-03T14:37:52+00:00 bcook 2016-09-03T14:37:52+00:00 urn:sha1:f826e0ef7a6d62b2aaaf3475bc001f300d6cd832 Don't dereference |d| when |top| is zero. Also test that various BIGNUM methods behave correctly on zero/even inputs. Original patch from OpenSSL commit d46e946d2603c64df6e1e4f9db0c70baaf1c4c03 Correct spelling of OPENSSL_cleanse. 2015-09-10T15:56:26+00:00 jsing 2015-09-10T15:56:26+00:00 urn:sha1:647569a51c1530d10e75e272f0982682f696caa7 ok miod@ Fix indentation that incorrectly implies a different control flow. 2015-03-21T08:05:20+00:00 doug 2015-03-21T08:05:20+00:00 urn:sha1:49c3a24c899173341c1bbdfe1fe50329dc016723 The actual control flow is intentional while the indenting is incorrect. This is intended to be a cosmetic change. Verified that each of these was part of a KNF commit that wasn't intending to change behavior. Also, double checked against the history of changes in OpenSSL and BoringSSL. Addresses Coverity CIDs: 78842, 78859, 78863. ok tedu@