From d0bd014cdc526e4c2c4d4a2c7cc7cc089664a114 Mon Sep 17 00:00:00 2001
From: tb <>
Date: Sun, 24 Nov 2024 10:12:05 +0000
Subject: Disable small builtin curves

This disables all the curves over fields < 224 bits and a few others.
Specifically:

SECG: 112r1 112r2 128r1 128r2 160k1 160r1 160r2 192k1 192r1 192v{1,2,3}
WTLS: 6 7 8 9 12
Brainpool: P160r1 P160t1 P192r1 P192t1

These are below or at the limit of what is acceptable nowadays. This is
less aggressive than what some enterprise linux distributions are using
in their patched OpenSSL versions where everything over fields < 256 bits
is disabled with the exception of P-224, so interoperability should not
be a problem.

The curves are left in the tree for now and can be re-enabled by compiling
libcrypto with -DENABLE_SMALL_CURVES. They will be fully removed later.

One nice benefit of doing this is that the incorrect parameters for WTLS 7
are fixed (obviously nobody uses this one) and now all the builtin curves
have a unique corresponding OID (nid).

Something like this was suggested a while back by beck, makes sense to sthen

ok jsing
---
 src/lib/libcrypto/ec/ec_curve.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/lib/libcrypto/ec/ec_curve.c b/src/lib/libcrypto/ec/ec_curve.c
index 3face800e4..fd7831598b 100644
--- a/src/lib/libcrypto/ec/ec_curve.c
+++ b/src/lib/libcrypto/ec/ec_curve.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_curve.c,v 1.49 2024/10/23 10:41:51 tb Exp $ */
+/* $OpenBSD: ec_curve.c,v 1.50 2024/11/24 10:12:05 tb Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -83,6 +83,8 @@
 
 #include "ec_local.h"
 
+#ifdef ENABLE_SMALL_CURVES
+
 /* the nist prime curves */
 static const struct {
 	uint8_t seed[20];
@@ -129,6 +131,8 @@ static const struct {
 	},
 };
 
+#endif /* ENABLE_SMALL_CURVES */
+
 static const struct {
 	uint8_t seed[20];
 	uint8_t p[28];
@@ -300,6 +304,8 @@ static const struct {
 	},
 };
 
+#ifdef ENABLE_SMALL_CURVES
+
 /* the x9.62 prime curves (minus the nist prime curves) */
 static const struct {
 	uint8_t seed[20];
@@ -391,6 +397,8 @@ static const struct {
 	},
 };
 
+#endif /* ENABLE_SMALL_CURVES */
+
 static const struct {
 	uint8_t seed[20];
 	uint8_t p[30];
@@ -577,6 +585,8 @@ static const struct {
 	},
 };
 
+#ifdef ENABLE_SMALL_CURVES
+
 /* the secg prime curves (minus the nist and x9.62 prime curves) */
 static const struct {
 	uint8_t seed[20];
@@ -904,6 +914,8 @@ static const struct {
 	},
 };
 
+#endif /* ENABLE_SMALL_CURVES */
+
 static const struct {
 	uint8_t p[29];
 	uint8_t a[29];
@@ -990,6 +1002,8 @@ static const struct {
 	},
 };
 
+#ifdef ENABLE_SMALL_CURVES
+
 /* some wap/wtls curves */
 static const struct {
 	uint8_t p[15];
@@ -1253,6 +1267,8 @@ static const struct {
 	},
 };
 
+#endif /* ENABLE_SMALL_CURVES */
+
 static const struct {
 	uint8_t p[28];
 	uint8_t a[28];
@@ -1810,6 +1826,7 @@ static const struct ec_curve {
 	const uint8_t *order;
 } ec_curve_list[] = {
 	/* secg curves */
+#ifdef ENABLE_SMALL_CURVES
 	{
 		.comment = "SECG/WTLS curve over a 112 bit prime field",
 		.nid = NID_secp112r1,
@@ -1919,6 +1936,7 @@ static const struct ec_curve {
 		.order = _EC_SECG_PRIME_192K1.order,
 		.cofactor = 1,
 	},
+#endif /* ENABLE_SMALL_CURVES */
 	{
 		.comment = "SECG curve over a 224 bit prime field",
 		.nid = NID_secp224k1,
@@ -1987,6 +2005,7 @@ static const struct ec_curve {
 		.cofactor = 1,
 	},
 	/* X9.62 curves */
+#ifdef ENABLE_SMALL_CURVES
 	{
 		.comment = "NIST/X9.62/SECG curve over a 192 bit prime field",
 		.nid = NID_X9_62_prime192v1,
@@ -2029,6 +2048,7 @@ static const struct ec_curve {
 		.order = _EC_X9_62_PRIME_192V3.order,
 		.cofactor = 1,
 	},
+#endif /* ENABLE_SMALL_CURVES */
 	{
 		.comment = "X9.62 curve over a 239 bit prime field",
 		.nid = NID_X9_62_prime239v1,
@@ -2085,6 +2105,7 @@ static const struct ec_curve {
 		.order = _EC_X9_62_PRIME_256V1.order,
 		.cofactor = 1,
 	},
+#ifdef ENABLE_SMALL_CURVES
 	{
 		.comment = "SECG/WTLS curve over a 112 bit prime field",
 		.nid = NID_wap_wsg_idm_ecid_wtls6,
@@ -2198,6 +2219,7 @@ static const struct ec_curve {
 		.order = _EC_brainpoolP192t1.order,
 		.cofactor = 1,
 	},
+#endif /* ENABLE_SMALL_CURVES */
 	{
 		.comment = "RFC 5639 curve over a 224 bit prime field",
 		.nid = NID_brainpoolP224r1,
-- 
cgit v1.2.3-55-g6feb