resolve conflicts

4 files changed, 74 insertions, 32 deletions

diff --git a/src/lib/libcrypto/dh/dh.h b/src/lib/libcrypto/dh/dh.h
index 0aff7fe21f..8562d16fb7 100644
--- a/src/lib/libcrypto/dh/dh.h
+++ b/src/lib/libcrypto/dh/dh.h
@@ -70,7 +70,14 @@
 #include <openssl/crypto.h>
 #include <openssl/ossl_typ.h>
         
-#define DH_FLAG_CACHE_MONT_P    0x01
+#define DH_FLAG_CACHE_MONT_P     0x01
+#define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH
+                                       * implementation now uses constant time
+                                       * modular exponentiation for secret exponents
+                                       * by default. This flag causes the
+                                       * faster variable sliding window method to
+                                       * be used for all exponents.
+                                       */
 
 #ifdef  __cplusplus
 extern "C" {
diff --git a/src/lib/libcrypto/dh/dh_err.c b/src/lib/libcrypto/dh/dh_err.c
index 914b8a9c53..9336bfce6b 100644
--- a/src/lib/libcrypto/dh/dh_err.c
+++ b/src/lib/libcrypto/dh/dh_err.c
@@ -1,6 +1,6 @@
 /* crypto/dh/dh_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -64,22 +64,26 @@
 
 /* BEGIN ERROR CODES */
 #ifndef OPENSSL_NO_ERR
+
+#define ERR_FUNC(func) ERR_PACK(ERR_LIB_DH,func,0)
+#define ERR_REASON(reason) ERR_PACK(ERR_LIB_DH,0,reason)
+
 static ERR_STRING_DATA DH_str_functs[]=
         {
-{ERR_PACK(0,DH_F_DHPARAMS_PRINT,0),     "DHparams_print"},
-{ERR_PACK(0,DH_F_DHPARAMS_PRINT_FP,0),  "DHparams_print_fp"},
-{ERR_PACK(0,DH_F_DH_COMPUTE_KEY,0),     "DH_compute_key"},
-{ERR_PACK(0,DH_F_DH_GENERATE_KEY,0),    "DH_generate_key"},
-{ERR_PACK(0,DH_F_DH_GENERATE_PARAMETERS,0),     "DH_generate_parameters"},
-{ERR_PACK(0,DH_F_DH_NEW_METHOD,0),      "DH_new_method"},
+{ERR_FUNC(DH_F_DHPARAMS_PRINT), "DHparams_print"},
+{ERR_FUNC(DH_F_DHPARAMS_PRINT_FP),      "DHparams_print_fp"},
+{ERR_FUNC(DH_F_DH_COMPUTE_KEY), "DH_compute_key"},
+{ERR_FUNC(DH_F_DH_GENERATE_KEY),        "DH_generate_key"},
+{ERR_FUNC(DH_F_DH_GENERATE_PARAMETERS), "DH_generate_parameters"},
+{ERR_FUNC(DH_F_DH_NEW_METHOD),  "DH_new_method"},
 {0,NULL}
         };
 
 static ERR_STRING_DATA DH_str_reasons[]=
         {
-{DH_R_BAD_GENERATOR                      ,"bad generator"},
-{DH_R_NO_PRIVATE_VALUE                   ,"no private value"},
-{DH_R_INVALID_PUBKEY                     ,"invalid public key"},
+{ERR_REASON(DH_R_BAD_GENERATOR)          ,"bad generator"},
+{ERR_REASON(DH_R_NO_PRIVATE_VALUE)       ,"no private value"},
+{ERR_REASON(DH_R_INVALID_PUBKEY)         ,"invalid public key"},
 {0,NULL}
         };
 
@@ -93,8 +97,8 @@ void ERR_load_DH_strings(void)
                 {
                 init=0;
 #ifndef OPENSSL_NO_ERR
-                ERR_load_strings(ERR_LIB_DH,DH_str_functs);
-                ERR_load_strings(ERR_LIB_DH,DH_str_reasons);
+                ERR_load_strings(0,DH_str_functs);
+                ERR_load_strings(0,DH_str_reasons);
 #endif
 
                 }
diff --git a/src/lib/libcrypto/dh/dh_key.c b/src/lib/libcrypto/dh/dh_key.c
index 648766a6ec..e3641ec468 100644
--- a/src/lib/libcrypto/dh/dh_key.c
+++ b/src/lib/libcrypto/dh/dh_key.c
@@ -105,7 +105,7 @@ static int generate_key(DH *dh)
         int generate_new_key=0;
         unsigned l;
         BN_CTX *ctx;
-        BN_MONT_CTX *mont;
+        BN_MONT_CTX *mont=NULL;
         BIGNUM *pub_key=NULL,*priv_key=NULL;
 
         ctx = BN_CTX_new();
@@ -128,21 +128,37 @@ static int generate_key(DH *dh)
         else
                 pub_key=dh->pub_key;
 
-        if ((dh->method_mont_p == NULL) && (dh->flags & DH_FLAG_CACHE_MONT_P))
+
+        if (dh->flags & DH_FLAG_CACHE_MONT_P)
                 {
-                if ((dh->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dh->method_mont_p,
-                                dh->p,ctx)) goto err;
+                mont = BN_MONT_CTX_set_locked(
+                                (BN_MONT_CTX **)&dh->method_mont_p,
+                                CRYPTO_LOCK_DH, dh->p, ctx);
+                if (!mont)
+                        goto err;
                 }
-        mont=(BN_MONT_CTX *)dh->method_mont_p;
 
         if (generate_new_key)
                 {
                 l = dh->length ? dh->length : BN_num_bits(dh->p)-1; /* secret exponent length */
                 if (!BN_rand(priv_key, l, 0, 0)) goto err;
                 }
-        if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, priv_key,dh->p,ctx,mont))
-                goto err;
+
+        {
+                BIGNUM local_prk;
+                BIGNUM *prk;
+
+                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
+                        {
+                        BN_init(&local_prk);
+                        prk = &local_prk;
+                        BN_with_flags(prk, priv_key, BN_FLG_EXP_CONSTTIME);
+                        }
+                else
+                        prk = priv_key;
+
+                if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) goto err;
+        }
                 
         dh->pub_key=pub_key;
         dh->priv_key=priv_key;
@@ -160,7 +176,7 @@ err:
 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
         {
         BN_CTX *ctx;
-        BN_MONT_CTX *mont;
+        BN_MONT_CTX *mont=NULL;
         BIGNUM *tmp;
         int ret= -1;
         int check_result;
@@ -175,15 +191,20 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
                 DHerr(DH_F_DH_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);
                 goto err;
                 }
-        if ((dh->method_mont_p == NULL) && (dh->flags & DH_FLAG_CACHE_MONT_P))
+
+        if (dh->flags & DH_FLAG_CACHE_MONT_P)
                 {
-                if ((dh->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                        if (!BN_MONT_CTX_set((BN_MONT_CTX *)dh->method_mont_p,
-                                dh->p,ctx)) goto err;
+                mont = BN_MONT_CTX_set_locked(
+                                (BN_MONT_CTX **)&dh->method_mont_p,
+                                CRYPTO_LOCK_DH, dh->p, ctx);
+                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
+                        {
+                        /* XXX */
+                        BN_set_flags(dh->priv_key, BN_FLG_EXP_CONSTTIME);
+                        }
+                if (!mont)
+                        goto err;
                 }
-
-        mont=(BN_MONT_CTX *)dh->method_mont_p;
-
         if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result)
                 {
                 DHerr(DH_F_DH_COMPUTE_KEY,DH_R_INVALID_PUBKEY);
@@ -197,8 +218,11 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
 
         ret=BN_bn2bin(tmp,key);
 err:
-        BN_CTX_end(ctx);
-        BN_CTX_free(ctx);
+        if (ctx != NULL)
+                {
+                BN_CTX_end(ctx);
+                BN_CTX_free(ctx);
+                }
         return(ret);
         }
 
@@ -207,7 +231,10 @@ static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
                         const BIGNUM *m, BN_CTX *ctx,
                         BN_MONT_CTX *m_ctx)
         {
-        if (a->top == 1)
+        /* If a is only one word long and constant time is false, use the faster
+         * exponenentiation function.
+         */
+        if (a->top == 1 && ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) != 0))
                 {
                 BN_ULONG A = a->d[0];
                 return BN_mod_exp_mont_word(r,A,p,m,ctx,m_ctx);
diff --git a/src/lib/libcrypto/dh/dhtest.c b/src/lib/libcrypto/dh/dhtest.c
index d75077f9fa..b76dede771 100644
--- a/src/lib/libcrypto/dh/dhtest.c
+++ b/src/lib/libcrypto/dh/dhtest.c
@@ -136,6 +136,10 @@ int main(int argc, char *argv[])
         b->g=BN_dup(a->g);
         if ((b->p == NULL) || (b->g == NULL)) goto err;
 
+        /* Set a to run with normal modexp and b to use constant time */
+        a->flags &= ~DH_FLAG_NO_EXP_CONSTTIME;
+        b->flags |= DH_FLAG_NO_EXP_CONSTTIME;
+
         if (!DH_generate_key(a)) goto err;
         BIO_puts(out,"pri 1=");
         BN_print(out,a->priv_key);