openbsd/src/lib/libcrypto/ecdsa, branch OPENBSD_6_4_BASE

Factor out a bit of ugly code that truncates the digest to the order_bits

2018-07-10T21:36:02+00:00

leftmost bits of a longer digest, according to FIPS 183-6, 6.4. Eliminate a microoptimization that only converts the relevant part of the digest to a bignum. ok beck, jsing

Tiny tweak to the blinding comment.

2018-06-16T08:11:33+00:00

Basic cleanup. Handle the possibly NULL ctx_in in ecdsa_sign_setup() with

2018-06-15T19:24:13+00:00

the usual idiom. All the allocations are now handled inside conditionals as is usually done in this part of the tree. Turn a few comments into actual sentences and remove a few self-evident ones. Change outdated or cryptic comments into more helpful annotations. In ecdsa_do_verify(), start calculating only after properly truncating the message digest. More consistent variable names: prefer 'order_bits' and 'point' over 'i' and 'tmp_point'. ok jsing

Clean up some whitespace and polish a few comments. Reduces noise in

2018-06-15T05:00:41+00:00

an upcoming diff.

Use a blinding value when generating an ECDSA signature, in order to

2018-06-14T18:51:01+00:00

reduce the possibility of a side-channel attack leaking the private key. Suggested by Keegan Ryan at NCC Group. With input from and ok jsing

Avoid a timing side-channel leak when generating DSA and ECDSA signatures.

2018-06-13T15:05:04+00:00

This is caused by an attempt to do fast modular arithmetic, which introduces branches that leak information regarding secret values. Issue identified and reported by Keegan Ryan of NCC Group. ok beck@ tb@

Fix a small timing side channel in ecdsa_sign_setup(). Up to whitespace

2018-04-28T14:17:56+00:00

this is OpennSSL commit 4a089bbdf11f9e231cc68f42bba934c954d81a49. ok beck, jsing Original commit message: commit 4a089bbdf11f9e231cc68f42bba934c954d81a49 Author: Pauli Date: Wed Nov 1 06:58:39 2017 +1000 Address a timing side channel whereby it is possible to determine some information about the length of the scalar used in ECDSA operations from a large number (2^32) of signatures. This doesn't rate as a CVE because: * For the non-constant time code, there are easier ways to extract more information. * For the constant time code, it requires a significant number of signatures to leak a small amount of information. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Reviewed-by: Andy Polyakov Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4576)]

make ENGINE_finish() succeed on NULL and simplify callers as in

2018-04-14T07:09:21+00:00

OpenSSL commit 7c96dbcdab9 by Rich Salz. This cleans up the caller side quite a bit and reduces the number of lines enclosed in #ifndef OPENSSL_NO_ENGINE. codesearch.debian.net shows that almost nothing checks the return value of ENGINE_finish(). While there, replace a few nearby 'if (!ptr)' with 'if (ptr == NULL)'. ok jsing, tested by & ok inoguchi

Provide ECDSA_SIG_{g,s}et0().

2018-03-17T15:24:44+00:00

ok jsing

use freezero() instead of memset/explicit_bzero + free. Substantially

2017-05-02T03:59:45+00:00

reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck