MFC: Avoid a timing side-channel leak when generating DSA and ECDSA

signatures.

This is caused by an attempt to do fast modular arithmetic, which
introduces branches that leak information regarding secret values.

Issue identified and reported by Keegan Ryan of NCC Group.

ok beck@ tb@

1 files changed, 2 insertions, 5 deletions

diff --git a/src/lib/libcrypto/dsa/dsa_ossl.c b/src/lib/libcrypto/dsa/dsa_ossl.c
index f1013fe547..78b10a5b88 100644
--- a/src/lib/libcrypto/dsa/dsa_ossl.c
+++ b/src/lib/libcrypto/dsa/dsa_ossl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_ossl.c,v 1.30 2017/01/29 17:49:22 beck Exp $ */
+/* $OpenBSD: dsa_ossl.c,v 1.30.6.1 2018/06/13 15:07:19 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -142,11 +142,8 @@ redo:
         /* Compute  s = inv(k) (m + xr) mod q */
         if (!BN_mod_mul(&xr, dsa->priv_key, r, dsa->q, ctx))    /* s = xr */
                 goto err;
-        if (!BN_add(s, &xr, &m))                                /* s = m + xr */
+        if (!BN_mod_add(s, &xr, &m, dsa->q, ctx))               /* s = m + xr */
                 goto err;
-        if (BN_cmp(s, dsa->q) > 0)
-                if (!BN_sub(s, s, dsa->q))
-                        goto err;
         if (!BN_mod_mul(s, s, kinv, dsa->q, ctx))
                 goto err;