From fe6f3fc2532579fc0941a1603d5e19a11a013179 Mon Sep 17 00:00:00 2001 From: beck <> Date: Wed, 25 Jan 2017 06:15:44 +0000 Subject: Construct a BN_gcd_nonct, based on BN_mod_inverse_no_branch, as suggested by Alejandro Cabrera to avoid the possibility of a sidechannel timing attack during RSA private key generation. Modify BN_gcd to become not visible under LIBRESSL_INTERNAL and force the use of the _ct or _nonct versions of the function only within the library. ok jsing@ --- src/lib/libcrypto/rsa/rsa_gen.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src/lib/libcrypto/rsa/rsa_gen.c') diff --git a/src/lib/libcrypto/rsa/rsa_gen.c b/src/lib/libcrypto/rsa/rsa_gen.c index 300b292b7b..e09dccb4a8 100644 --- a/src/lib/libcrypto/rsa/rsa_gen.c +++ b/src/lib/libcrypto/rsa/rsa_gen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rsa_gen.c,v 1.20 2017/01/21 11:00:47 beck Exp $ */ +/* $OpenBSD: rsa_gen.c,v 1.21 2017/01/25 06:15:44 beck Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -138,7 +138,7 @@ rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) goto err; if (!BN_sub(r2, rsa->p, BN_value_one())) goto err; - if (!BN_gcd(r1, r2, rsa->e, ctx)) + if (!BN_gcd_ct(r1, r2, rsa->e, ctx)) goto err; if (BN_is_one(r1)) break; @@ -168,7 +168,7 @@ rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, BN_GENCB *cb) } if (!BN_sub(r2, rsa->q, BN_value_one())) goto err; - if (!BN_gcd(r1, r2, rsa->e, ctx)) + if (!BN_gcd_ct(r1, r2, rsa->e, ctx)) goto err; if (BN_is_one(r1)) break; -- cgit v1.2.3-55-g6feb