openbsd/src/lib/libcrypto/bn/bn_lib.c, branch OPENBSD_6_8_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE2019-06-17T17:11:48+00:00Make BN_num_bits_word() constant time.2019-06-17T17:11:48+00:00tb2019-06-17T17:11:48+00:00urn:sha1:aad713565aa006bc353dc31ecaa5e9f0aa3de235
Previously, this function would leak the most significant word of its
argument due to branching and memory access pattern. This patch is
enough to fix the use of BN_num_bits() on RSA prime factors in the
library.
The diff is a simplified and more readable (but perhaps less efficient)
version of https://github.com/openssl/openssl/commit/972c87df
by Andy Polyakov and David Benjamin (pre license change). Consult that
commit message for details. Subsequent fixes to follow in the near future.
Issue pointed out by David Schrammel and Samuel Weiser as part of
a larger report.
tests & ok inoguchi, ok jsing
Add range checks to varios ASN1_INTEGER functions to ensure the2019-03-23T18:48:15+00:00beck2019-03-23T18:48:15+00:00urn:sha1:c7b9ffc836ad7a05586d7c83c368d784af9cacda
sizes used remain a positive integer. Should address issue
13799 from oss-fuzz
ok tb@ jsing@
Use a size_t instead of an int for the byte count in BN_swap_ct().2018-07-23T18:14:32+00:00tb2018-07-23T18:14:32+00:00urn:sha1:1b961cfb65c1f00f26f20454324577edec589a1b
Since bignums use ints for the same purpose, this still uses an int
internally after an overflow check.
Suggested by and discussed with jsing.
ok inoguchi, jsing
Eliminate the weird condition in the BN_swap_ct() API that at most one bit2018-07-13T08:43:31+00:00tb2018-07-13T08:43:31+00:00urn:sha1:30d844db17bda4a9465f89832a192a4685d70d38
be set in condition. This makes the constant time bit-twiddling a bit
trickier, but it's not too bad. Thanks to halex for an extensive rubber
ducking session over a non-spicy spicy tabouleh falafel..
ok jsing, kn
Sync comment2018-07-11T13:57:53+00:00kn2018-07-11T13:57:53+00:00urn:sha1:f1a8f36c4bd220fad86be1b60aa0105b32e88eee
Makes it a tad easier to read through and compare with BN_swap_ct().
OK tb
Turn yesterday's optimistic ! in an XXX comment into a more cautious ?2018-07-11T07:38:00+00:00tb2018-07-11T07:38:00+00:00urn:sha1:467436bd0e4e1edb3f39ae645b8aba182e9b2b23Provide BN_swap_ct(), a constant time function that conditionally swaps2018-07-10T21:52:07+00:00tb2018-07-10T21:52:07+00:00urn:sha1:56d9c9fb3e9ee89475112311a073d8411159080c
two bignums. It's saner and substantially less ugly than the existing
public BN_constantime_swap() function and will be used in forthcoming work
on constant time ECC code.
From Billy Brumley and his team. Thanks!
ok jsing
Use explicit_bzero() rather than memset() when clearing a BIGNUM.2018-05-12T17:31:41+00:00jsing2018-05-12T17:31:41+00:00urn:sha1:c3079e78e6b75e352ffdf7f47cb431867798c366
ok bcook@ tb@
Provide BN_GENCB_new(), BN_GENCB_free() and BN_GENCB_get_arg()2018-02-20T17:13:14+00:00jsing2018-02-20T17:13:14+00:00urn:sha1:293a70c9811459080f491f606e3ce48530401462use freezero() instead of memset/explicit_bzero + free. Substantially2017-05-02T03:59:45+00:00deraadt2017-05-02T03:59:45+00:00urn:sha1:5904cc0e04409fde39a97e6580535da34eeb4291
reduces conditional logic (-218, +82).
MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c
wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and
BN_FLG_STATIC_DATA where the condition cannot be collapsed completely.
Passes regress. ok beck