openbsd/src/lib/libcrypto/bn, branch OPENBSD_7_3_BASE

Ensure negative input to BN_mod_exp_mont_consttime() is correctly reduced.

2023-03-15T04:30:20+00:00

A negative input to BN_mod_exp_mont_consttime() is not correctly reduced, remaining negative (when it should be in the range [0, m)). Fix this by unconditionally calling BN_nnmod() on the input. Fixes ossfuzz #55997. ok tb@

Avoid -0 in BN_div_word().

2023-03-11T14:14:54+00:00

Currently, the use of BN_div_word() can result in -0 - avoid this by setting negative again, at the end of the computation. Should fix oss-fuzz 56667. ok tb@

Correct sign handling in BN_add_word().

2023-03-11T14:13:11+00:00

A sign handling bug was introduced to BN_add_word() in bn_word.c r1.18. When handling addition to a negative bignum, the BN_sub_word() call can result in the sign being flipped, which we need to account for. Use the same code in BN_sub_word() - while not technically needed here it keeps the code consistent. Issue discovered by tb@ ok tb@

Improve bn_montgomery_multiply_words().

2023-03-07T09:42:09+00:00

Rather than calling bn_mul_add_words() twice - once to multiply and once to reduce - perform the multiplication and reduction in a single pass using bn_mulw_addw_addw() directly. Also simplify the addition of the resulting carries, which in turn allows us to avoid zeroing the top half of the temporary words. This provides a ~20-25% performance improvement for RSA operations on aarch64. ok tb@

Slightly rework bn_mulw_addtw().

2023-03-07T09:35:55+00:00

Call bn_mulw_addw() rather than doing bn_mulw() follow by bn_addw(). This simplifies the code slightly, plus on some platforms bn_mulw_addw() can be optimised (and bn_mulw_addtw() will then benefit from such an optimisation). ok tb@

Call BN_free() instead of BN_clear_free().

2023-03-07T09:27:10+00:00

BN_clear_free() is a wrapper that calls BN_free() - call BN_free() directly instead. ok tb@

Limit bn_mul_mont() usage to sizes less than or equal to 8192 bits.

2023-03-07T06:28:36+00:00

The assembly bn_mul_mont() implementations effectively use alloca() to allocate space for computation (at up to 8x the input size), without any limitation. This means that sufficiently large inputs lead to the stack being blown. Prevent this by using the C based implementation instead. Thanks to Jiayi Lin for reporting this to us. ok beck@ tb@

Implement bn_montgomery_multiply()

2023-03-07T06:19:44+00:00

Provide a constant-time-style Montgomery multiplication implementation. Use this in place of the assembly bn_mul_mont() on platforms that either do not have an assembly implementation or have not compiled it in. Also use this as the fallback version for bn_mul_mont(), rather than falling back to a non-constant time implementation. ok beck@ tb@

Refactor BN_mod_mul_montgomery().

2023-03-07T06:15:09+00:00

Pull out the simplistic implementation (using BN_mul() or BN_sqr()) into a bn_mod_mul_montgomery_simple() function. Provide bn_mod_mul_montgomery() with an implementation that changes depending on if the assembly bn_mul_mont() is available or not. Turn BN_mod_mul_montgomery() and BN_to_montgomery() into callers of bn_mod_mul_montgomery(). ok beck@ tb@

Delete unused and unsafe bn_mul_mont() example code.

2023-03-07T06:05:06+00:00

This came from bn_asm.c and did not even compile until recently. ok beck@ tb@