openbsd/src/lib/libcrypto/ec, branch libressl-v2.9.0

Port OpenSSL commit 99540ec79491f59ed8b46b4edf130e17dc907f52 -- mitigation

2018-11-15T05:53:31+00:00

for a timing vullnerability in ECDSA signature generation (CVE-2018-0735). Note that the blinding that we introduced back in June for ECDSA and DSA should mitigate this and related issues. This simply adds an additional layer of protection. discussed with jsing

Avoid dereferencing eckey before checking it for NULL.

2018-11-09T23:39:45+00:00

CID 184282 ok beck jsing mestre

unrevert the use of bn_rand_interval().

2018-11-06T07:02:33+00:00

ok beck jsing

Unset Z_is_zero after applying coordinate blinding and

2018-11-06T06:59:25+00:00

re-enable coordinate blinding. ok jsing

disable EC_POINT coordinate blinding due to failures in ECDHE and TLS

2018-11-06T02:16:13+00:00

revert use of bn_rand_interval due to failures with ECDHE and TLS

2018-11-06T02:14:39+00:00

Make use of bn_rand_interval() where appropriate.

2018-11-05T23:54:27+00:00

ok beck jsing

Eliminate a few "} else" branches, a few unneeded NULL checks before

2018-11-05T23:50:05+00:00

freeing and indent nearby labels. ok beck jsing

Implement coordinate blinding for EC_POINT.

2018-11-05T20:18:21+00:00

Based on OpenSSL commit 875ba8b21ecc65ad9a6bdc66971e50 by Billy Brumley, Sohaib ul Hassan and Nicola Tuveri. ok beck jsing commit 875ba8b21ecc65ad9a6bdc66971e50461660fcbb Author: Sohaib ul Hassan Date: Sat Jun 16 17:07:40 2018 +0300 Implement coordinate blinding for EC_POINT This commit implements coordinate blinding, i.e., it randomizes the representative of an elliptic curve point in its equivalence class, for prime curves implemented through EC_GFp_simple_method, EC_GFp_mont_method, and EC_GFp_nist_method. This commit is derived from the patch https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley. Coordinate blinding is a generally useful side-channel countermeasure and is (mostly) free. The function itself takes a few field multiplicationss, but is usually only necessary at the beginning of a scalar multiplication (as implemented in the patch). When used this way, it makes the values that variables take (i.e., field elements in an algorithm state) unpredictable. For instance, this mitigates chosen EC point side-channel attacks for settings such as ECDH and EC private key decryption, for the aforementioned curves. For EC_METHODs using different coordinate representations this commit does nothing, but the corresponding coordinate blinding function can be easily added in the future to extend these changes to such curves. Co-authored-by: Nicola Tuveri Co-authored-by: Billy Brumley Reviewed-by: Tim Hudson Reviewed-by: Nicola Tuveri Reviewed-by: Andy Polyakov (Merged from https://github.com/openssl/openssl/pull/6526)

Tweak comment.

2018-09-01T16:23:15+00:00