If a NULL or zero cofactor is passed to EC_GROUP_set_generator(),

try to compute it using Hasse's bound.  This works as long as the
cofactor is small enough.

Port of Brumley's fix for CVE-2019-1547 in OpenSSL 1.1.1 (old license)

tests & ok inoguchi
input & ok jsing

commit 30c22fa8b1d840036b8e203585738df62a03cec8
Author: Billy Brumley <bbrumley@gmail.com>
Date:   Thu Sep 5 21:25:37 2019 +0300

    [crypto/ec] for ECC parameters with NULL or zero cofactor, compute it

    The cofactor argument to EC_GROUP_set_generator is optional, and SCA
    mitigations for ECC currently use it. So the library currently falls
    back to very old SCA-vulnerable code if the cofactor is not present.

    This PR allows EC_GROUP_set_generator to compute the cofactor for all
    curves of cryptographic interest. Steering scalar multiplication to more
    SCA-robust code.

    This issue affects persisted private keys in explicit parameter form,
    where the (optional) cofactor field is zero or absent.

    It also affects curves not built-in to the library, but constructed
    programatically with explicit parameters, then calling
    EC_GROUP_set_generator with a nonsensical value (NULL, zero).

    The very old scalar multiplication code is known to be vulnerable to
    local uarch attacks, outside of the OpenSSL threat model. New results
    suggest the code path is also vulnerable to traditional wall clock
    timing attacks.

    CVE-2019-1547

    Reviewed-by: Matt Caswell <matt@openssl.org>
    Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
    Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
    (Merged from https://github.com/openssl/openssl/pull/9781)

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lib/libcrypto/ec/ec.h b/src/lib/libcrypto/ec/ec.h
index d0e3673675..a95d99f6a9 100644
--- a/src/lib/libcrypto/ec/ec.h
+++ b/src/lib/libcrypto/ec/ec.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec.h,v 1.17 2019/09/06 17:59:25 jsing Exp $ */
+/* $OpenBSD: ec.h,v 1.18 2019/09/29 10:09:09 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -1286,6 +1286,7 @@ void ERR_load_EC_strings(void);
 #define EC_R_SLOT_FULL                                   108
 #define EC_R_UNDEFINED_GENERATOR                         113
 #define EC_R_UNDEFINED_ORDER                             128
+#define EC_R_UNKNOWN_COFACTOR                            164
 #define EC_R_UNKNOWN_GROUP                               129
 #define EC_R_UNKNOWN_ORDER                               114
 #define EC_R_UNSUPPORTED_FIELD                           131