diff options
Diffstat (limited to 'src/lib/libcrypto/bn/bn_blind.c')
-rw-r--r-- | src/lib/libcrypto/bn/bn_blind.c | 249 |
1 files changed, 14 insertions, 235 deletions
diff --git a/src/lib/libcrypto/bn/bn_blind.c b/src/lib/libcrypto/bn/bn_blind.c index c11fb4ccc2..2d287e6d1b 100644 --- a/src/lib/libcrypto/bn/bn_blind.c +++ b/src/lib/libcrypto/bn/bn_blind.c | |||
@@ -1,57 +1,4 @@ | |||
1 | /* crypto/bn/bn_blind.c */ | 1 | /* crypto/bn/bn_blind.c */ |
2 | /* ==================================================================== | ||
3 | * Copyright (c) 1998-2005 The OpenSSL Project. All rights reserved. | ||
4 | * | ||
5 | * Redistribution and use in source and binary forms, with or without | ||
6 | * modification, are permitted provided that the following conditions | ||
7 | * are met: | ||
8 | * | ||
9 | * 1. Redistributions of source code must retain the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer. | ||
11 | * | ||
12 | * 2. Redistributions in binary form must reproduce the above copyright | ||
13 | * notice, this list of conditions and the following disclaimer in | ||
14 | * the documentation and/or other materials provided with the | ||
15 | * distribution. | ||
16 | * | ||
17 | * 3. All advertising materials mentioning features or use of this | ||
18 | * software must display the following acknowledgment: | ||
19 | * "This product includes software developed by the OpenSSL Project | ||
20 | * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" | ||
21 | * | ||
22 | * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to | ||
23 | * endorse or promote products derived from this software without | ||
24 | * prior written permission. For written permission, please contact | ||
25 | * openssl-core@openssl.org. | ||
26 | * | ||
27 | * 5. Products derived from this software may not be called "OpenSSL" | ||
28 | * nor may "OpenSSL" appear in their names without prior written | ||
29 | * permission of the OpenSSL Project. | ||
30 | * | ||
31 | * 6. Redistributions of any form whatsoever must retain the following | ||
32 | * acknowledgment: | ||
33 | * "This product includes software developed by the OpenSSL Project | ||
34 | * for use in the OpenSSL Toolkit (http://www.openssl.org/)" | ||
35 | * | ||
36 | * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY | ||
37 | * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | ||
38 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | ||
39 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR | ||
40 | * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | ||
41 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
42 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | ||
43 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | ||
44 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, | ||
45 | * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | ||
46 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED | ||
47 | * OF THE POSSIBILITY OF SUCH DAMAGE. | ||
48 | * ==================================================================== | ||
49 | * | ||
50 | * This product includes cryptographic software written by Eric Young | ||
51 | * (eay@cryptsoft.com). This product includes software written by Tim | ||
52 | * Hudson (tjh@cryptsoft.com). | ||
53 | * | ||
54 | */ | ||
55 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) | 2 | /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) |
56 | * All rights reserved. | 3 | * All rights reserved. |
57 | * | 4 | * |
@@ -113,28 +60,11 @@ | |||
113 | #include "cryptlib.h" | 60 | #include "cryptlib.h" |
114 | #include "bn_lcl.h" | 61 | #include "bn_lcl.h" |
115 | 62 | ||
116 | #define BN_BLINDING_COUNTER 32 | 63 | BN_BLINDING *BN_BLINDING_new(BIGNUM *A, BIGNUM *Ai, BIGNUM *mod) |
117 | |||
118 | struct bn_blinding_st | ||
119 | { | ||
120 | BIGNUM *A; | ||
121 | BIGNUM *Ai; | ||
122 | BIGNUM *e; | ||
123 | BIGNUM *mod; /* just a reference */ | ||
124 | unsigned long thread_id; /* added in OpenSSL 0.9.6j and 0.9.7b; | ||
125 | * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */ | ||
126 | unsigned int counter; | ||
127 | unsigned long flags; | ||
128 | BN_MONT_CTX *m_ctx; | ||
129 | int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, | ||
130 | const BIGNUM *m, BN_CTX *ctx, | ||
131 | BN_MONT_CTX *m_ctx); | ||
132 | }; | ||
133 | |||
134 | BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, /* const */ BIGNUM *mod) | ||
135 | { | 64 | { |
136 | BN_BLINDING *ret=NULL; | 65 | BN_BLINDING *ret=NULL; |
137 | 66 | ||
67 | bn_check_top(Ai); | ||
138 | bn_check_top(mod); | 68 | bn_check_top(mod); |
139 | 69 | ||
140 | if ((ret=(BN_BLINDING *)OPENSSL_malloc(sizeof(BN_BLINDING))) == NULL) | 70 | if ((ret=(BN_BLINDING *)OPENSSL_malloc(sizeof(BN_BLINDING))) == NULL) |
@@ -143,21 +73,11 @@ BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, /* const */ BIGN | |||
143 | return(NULL); | 73 | return(NULL); |
144 | } | 74 | } |
145 | memset(ret,0,sizeof(BN_BLINDING)); | 75 | memset(ret,0,sizeof(BN_BLINDING)); |
146 | if (A != NULL) | 76 | if ((ret->A=BN_new()) == NULL) goto err; |
147 | { | 77 | if ((ret->Ai=BN_new()) == NULL) goto err; |
148 | if ((ret->A = BN_dup(A)) == NULL) goto err; | 78 | if (!BN_copy(ret->A,A)) goto err; |
149 | } | 79 | if (!BN_copy(ret->Ai,Ai)) goto err; |
150 | if (Ai != NULL) | 80 | ret->mod=mod; |
151 | { | ||
152 | if ((ret->Ai = BN_dup(Ai)) == NULL) goto err; | ||
153 | } | ||
154 | |||
155 | /* save a copy of mod in the BN_BLINDING structure */ | ||
156 | if ((ret->mod = BN_dup(mod)) == NULL) goto err; | ||
157 | if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0) | ||
158 | BN_set_flags(ret->mod, BN_FLG_CONSTTIME); | ||
159 | |||
160 | ret->counter = BN_BLINDING_COUNTER; | ||
161 | return(ret); | 81 | return(ret); |
162 | err: | 82 | err: |
163 | if (ret != NULL) BN_BLINDING_free(ret); | 83 | if (ret != NULL) BN_BLINDING_free(ret); |
@@ -171,8 +91,6 @@ void BN_BLINDING_free(BN_BLINDING *r) | |||
171 | 91 | ||
172 | if (r->A != NULL) BN_free(r->A ); | 92 | if (r->A != NULL) BN_free(r->A ); |
173 | if (r->Ai != NULL) BN_free(r->Ai); | 93 | if (r->Ai != NULL) BN_free(r->Ai); |
174 | if (r->e != NULL) BN_free(r->e ); | ||
175 | if (r->mod != NULL) BN_free(r->mod); | ||
176 | OPENSSL_free(r); | 94 | OPENSSL_free(r); |
177 | } | 95 | } |
178 | 96 | ||
@@ -185,181 +103,42 @@ int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx) | |||
185 | BNerr(BN_F_BN_BLINDING_UPDATE,BN_R_NOT_INITIALIZED); | 103 | BNerr(BN_F_BN_BLINDING_UPDATE,BN_R_NOT_INITIALIZED); |
186 | goto err; | 104 | goto err; |
187 | } | 105 | } |
188 | 106 | ||
189 | if (--(b->counter) == 0 && b->e != NULL && | 107 | if (!BN_mod_mul(b->A,b->A,b->A,b->mod,ctx)) goto err; |
190 | !(b->flags & BN_BLINDING_NO_RECREATE)) | 108 | if (!BN_mod_mul(b->Ai,b->Ai,b->Ai,b->mod,ctx)) goto err; |
191 | { | ||
192 | /* re-create blinding parameters */ | ||
193 | if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL)) | ||
194 | goto err; | ||
195 | } | ||
196 | else if (!(b->flags & BN_BLINDING_NO_UPDATE)) | ||
197 | { | ||
198 | if (!BN_mod_mul(b->A,b->A,b->A,b->mod,ctx)) goto err; | ||
199 | if (!BN_mod_mul(b->Ai,b->Ai,b->Ai,b->mod,ctx)) goto err; | ||
200 | } | ||
201 | 109 | ||
202 | ret=1; | 110 | ret=1; |
203 | err: | 111 | err: |
204 | if (b->counter == 0) | ||
205 | b->counter = BN_BLINDING_COUNTER; | ||
206 | return(ret); | 112 | return(ret); |
207 | } | 113 | } |
208 | 114 | ||
209 | int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) | 115 | int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) |
210 | { | 116 | { |
211 | return BN_BLINDING_convert_ex(n, NULL, b, ctx); | ||
212 | } | ||
213 | |||
214 | int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx) | ||
215 | { | ||
216 | int ret = 1; | ||
217 | |||
218 | bn_check_top(n); | 117 | bn_check_top(n); |
219 | 118 | ||
220 | if ((b->A == NULL) || (b->Ai == NULL)) | 119 | if ((b->A == NULL) || (b->Ai == NULL)) |
221 | { | 120 | { |
222 | BNerr(BN_F_BN_BLINDING_CONVERT_EX,BN_R_NOT_INITIALIZED); | 121 | BNerr(BN_F_BN_BLINDING_CONVERT,BN_R_NOT_INITIALIZED); |
223 | return(0); | 122 | return(0); |
224 | } | 123 | } |
225 | 124 | return(BN_mod_mul(n,n,b->A,b->mod,ctx)); | |
226 | if (r != NULL) | ||
227 | { | ||
228 | if (!BN_copy(r, b->Ai)) ret=0; | ||
229 | } | ||
230 | |||
231 | if (!BN_mod_mul(n,n,b->A,b->mod,ctx)) ret=0; | ||
232 | |||
233 | return ret; | ||
234 | } | 125 | } |
235 | 126 | ||
236 | int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) | 127 | int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) |
237 | { | 128 | { |
238 | return BN_BLINDING_invert_ex(n, NULL, b, ctx); | ||
239 | } | ||
240 | |||
241 | int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx) | ||
242 | { | ||
243 | int ret; | 129 | int ret; |
244 | 130 | ||
245 | bn_check_top(n); | 131 | bn_check_top(n); |
246 | if ((b->A == NULL) || (b->Ai == NULL)) | 132 | if ((b->A == NULL) || (b->Ai == NULL)) |
247 | { | 133 | { |
248 | BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED); | 134 | BNerr(BN_F_BN_BLINDING_INVERT,BN_R_NOT_INITIALIZED); |
249 | return(0); | 135 | return(0); |
250 | } | 136 | } |
251 | 137 | if ((ret=BN_mod_mul(n,n,b->Ai,b->mod,ctx)) >= 0) | |
252 | if (r != NULL) | ||
253 | ret = BN_mod_mul(n, n, r, b->mod, ctx); | ||
254 | else | ||
255 | ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx); | ||
256 | |||
257 | if (ret >= 0) | ||
258 | { | 138 | { |
259 | if (!BN_BLINDING_update(b,ctx)) | 139 | if (!BN_BLINDING_update(b,ctx)) |
260 | return(0); | 140 | return(0); |
261 | } | 141 | } |
262 | bn_check_top(n); | ||
263 | return(ret); | 142 | return(ret); |
264 | } | 143 | } |
265 | 144 | ||
266 | unsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *b) | ||
267 | { | ||
268 | return b->thread_id; | ||
269 | } | ||
270 | |||
271 | void BN_BLINDING_set_thread_id(BN_BLINDING *b, unsigned long n) | ||
272 | { | ||
273 | b->thread_id = n; | ||
274 | } | ||
275 | |||
276 | unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b) | ||
277 | { | ||
278 | return b->flags; | ||
279 | } | ||
280 | |||
281 | void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags) | ||
282 | { | ||
283 | b->flags = flags; | ||
284 | } | ||
285 | |||
286 | BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b, | ||
287 | const BIGNUM *e, /* const */ BIGNUM *m, BN_CTX *ctx, | ||
288 | int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, | ||
289 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx), | ||
290 | BN_MONT_CTX *m_ctx) | ||
291 | { | ||
292 | int retry_counter = 32; | ||
293 | BN_BLINDING *ret = NULL; | ||
294 | |||
295 | if (b == NULL) | ||
296 | ret = BN_BLINDING_new(NULL, NULL, m); | ||
297 | else | ||
298 | ret = b; | ||
299 | |||
300 | if (ret == NULL) | ||
301 | goto err; | ||
302 | |||
303 | if (ret->A == NULL && (ret->A = BN_new()) == NULL) | ||
304 | goto err; | ||
305 | if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL) | ||
306 | goto err; | ||
307 | |||
308 | if (e != NULL) | ||
309 | { | ||
310 | if (ret->e != NULL) | ||
311 | BN_free(ret->e); | ||
312 | ret->e = BN_dup(e); | ||
313 | } | ||
314 | if (ret->e == NULL) | ||
315 | goto err; | ||
316 | |||
317 | if (bn_mod_exp != NULL) | ||
318 | ret->bn_mod_exp = bn_mod_exp; | ||
319 | if (m_ctx != NULL) | ||
320 | ret->m_ctx = m_ctx; | ||
321 | |||
322 | do { | ||
323 | if (!BN_rand_range(ret->A, ret->mod)) goto err; | ||
324 | if (BN_mod_inverse(ret->Ai, ret->A, ret->mod, ctx) == NULL) | ||
325 | { | ||
326 | /* this should almost never happen for good RSA keys */ | ||
327 | unsigned long error = ERR_peek_last_error(); | ||
328 | if (ERR_GET_REASON(error) == BN_R_NO_INVERSE) | ||
329 | { | ||
330 | if (retry_counter-- == 0) | ||
331 | { | ||
332 | BNerr(BN_F_BN_BLINDING_CREATE_PARAM, | ||
333 | BN_R_TOO_MANY_ITERATIONS); | ||
334 | goto err; | ||
335 | } | ||
336 | ERR_clear_error(); | ||
337 | } | ||
338 | else | ||
339 | goto err; | ||
340 | } | ||
341 | else | ||
342 | break; | ||
343 | } while (1); | ||
344 | |||
345 | if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) | ||
346 | { | ||
347 | if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx)) | ||
348 | goto err; | ||
349 | } | ||
350 | else | ||
351 | { | ||
352 | if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx)) | ||
353 | goto err; | ||
354 | } | ||
355 | |||
356 | return ret; | ||
357 | err: | ||
358 | if (b == NULL && ret != NULL) | ||
359 | { | ||
360 | BN_BLINDING_free(ret); | ||
361 | ret = NULL; | ||
362 | } | ||
363 | |||
364 | return ret; | ||
365 | } | ||