openbsd/src/lib/libcrypto/bn, branch OPENBSD_7_0

Fix infinite loop in BN_mod_sqrt()

2022-03-15T15:54:26+00:00

A bug in the implementation of the Tonelli-Shanks algorithm can lead to an infinite loop. This loop can be hit in various ways, in particular on decompressing an elliptic curve public key via EC_POINT_oct2point() - to do this, one must solve y^2 = x^3 + ax + b for y, given x. If a certificate uses explicit encoding for elliptic curve parameters, this operation needs to be done during certificate verification, leading to a DoS. In particular, everything dealing with untrusted certificates is affected, notably TLS servers explicitly configured to request client certificates (httpd, smtpd, various VPN implementations, ...). Ordinary TLS servers do not consume untrusted certificates. The problem is that we cannot assume that x^3 + ax + b is actually a square on untrusted input and neither can we assume that the modulus p is a prime. Ensuring that p is a prime is too expensive (it would likely itself lead to a DoS). To avoid the infinite loop, fix the logic to be more resilient and explicitly limit the number of iterations that can be done. The bug is such that the infinite loop can also be hit for primes = 3 (mod 4) but fortunately that case is optimized earlier. It's also worth noting that there is a size bound on the field size enforced via OPENSSL_ECC_MAX_FIELD_BITS (= 661), which help mitigate further DoS vectors in presence of this fix. Reported by Tavis Ormandy and David Benjamin, Google Patch based on the fixes by David Benjamin and Tomas Mraz, OpenSSL ok beck inoguchi This is errata/7.0/016_bignum.patch.sig

Expose BN_bn2{,le}binpad() and BN_lebin2bn() in

2021-09-10T14:33:44+00:00

ok beck inoguchi

Expose BN_RAND_* in

2021-09-10T14:32:05+00:00

ok beck jsing

Prepare to provide BN_RAND_* flags for BN_rand_range()

2021-09-10T09:08:03+00:00

ok beck jsing

Prepare to provide BN_bn2{,le}binpad() and BN_lebin2bn()

2021-09-08T12:19:17+00:00

As found by jsg and patrick, this is needed for newer uboot and will also be used in upcoming elliptic curve work. This is from OpenSSL 1.1.1l with minor style tweaks. ok beck inoguchi

whitespace

2021-08-31T11:19:19+00:00

Unindent a bit of code that performs a few too many checks to

2020-09-12T17:16:36+00:00

figure out whether top > 0 or top == 0.

Avoid an out-of-bounds access in BN_rand()

2020-09-12T15:24:39+00:00

If BN_rand() is called with top > 0 and bits == 1, it would allocate a buf[] of size 1 and set the top bit of buf[1]. Found in OpenSSL commit efee575ad464bfb60bf72dcb73f9b51768f4b1a1 while looking for something else. ok beck djm inoguchi

Change generating and checking of primes so that the error rate of

2019-08-25T19:24:00+00:00

not being prime depends on the intended use based on the size of the input. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. Patch from Kurt Roeckx and Annie Yousar via OpenSSL commit feac7a1c Jul 25 18:55:16 2018 +0200, still under a free license. OK tb@.

make BN_CTX_end(NULL) a NOOP for compatibility with documented behaviour

2019-08-20T10:59:09+00:00

in OpenSSL 1.1.1 even though in general, letting random functions accept NULL is not advisable because it can hide programming errors; "yes please" tb@ "unfortunately I suspect you're right" jsing@ "oh well" deraadt@