diff options
| author |   jsing <jsing@openbsd.org> | 2018-06-13 15:05:04 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2018-06-13 15:05:04 +0000 |
| commit | f29541e5410001a6dd97e432b00d00cf05a54a86 (patch) | |
| tree | 9c30fa2dead90c60071c0331bfd103ce95c0d3a7 | |
| parent | Call pledge(2) earlier before opening the auth channel and readpassphrase() (diff) | |
| download | wireguard-openbsd-f29541e5410001a6dd97e432b00d00cf05a54a86.tar.xz wireguard-openbsd-f29541e5410001a6dd97e432b00d00cf05a54a86.zip | |
Avoid a timing side-channel leak when generating DSA and ECDSA signatures.
This is caused by an attempt to do fast modular arithmetic, which
introduces branches that leak information regarding secret values.
Issue identified and reported by Keegan Ryan of NCC Group.
ok beck@ tb@
| -rw-r--r-- | lib/libcrypto/dsa/dsa_ossl.c | 7 | ||||
| -rw-r--r-- | lib/libcrypto/ecdsa/ecs_ossl.c | 4 |
2 files changed, 4 insertions, 7 deletions
diff --git a/lib/libcrypto/dsa/dsa_ossl.c b/lib/libcrypto/dsa/dsa_ossl.c index 301cdd50950..505ef800dca 100644 --- a/lib/libcrypto/dsa/dsa_ossl.c +++ b/lib/libcrypto/dsa/dsa_ossl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: dsa_ossl.c,v 1.31 2018/04/28 14:22:21 tb Exp $ */ +/* $OpenBSD: dsa_ossl.c,v 1.32 2018/06/13 15:05:04 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -142,11 +142,8 @@ redo: /* Compute s = inv(k) (m + xr) mod q */ if (!BN_mod_mul(&xr, dsa->priv_key, r, dsa->q, ctx)) /* s = xr */ goto err; - if (!BN_add(s, &xr, &m)) /* s = m + xr */ + if (!BN_mod_add(s, &xr, &m, dsa->q, ctx)) /* s = m + xr */ goto err; - if (BN_cmp(s, dsa->q) > 0) - if (!BN_sub(s, s, dsa->q)) - goto err; if (!BN_mod_mul(s, s, kinv, dsa->q, ctx)) goto err; diff --git a/lib/libcrypto/ecdsa/ecs_ossl.c b/lib/libcrypto/ecdsa/ecs_ossl.c index 4ac140a0204..0f594aa86ee 100644 --- a/lib/libcrypto/ecdsa/ecs_ossl.c +++ b/lib/libcrypto/ecdsa/ecs_ossl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ecs_ossl.c,v 1.10 2018/04/28 14:17:56 tb Exp $ */ +/* $OpenBSD: ecs_ossl.c,v 1.11 2018/06/13 15:05:04 jsing Exp $ */ /* * Written by Nils Larsch for the OpenSSL project */ @@ -290,7 +290,7 @@ ecdsa_do_sign(const unsigned char *dgst, int dgst_len, ECDSAerror(ERR_R_BN_LIB); goto err; } - if (!BN_mod_add_quick(s, tmp, m, order)) { + if (!BN_mod_add(s, tmp, m, order, ctx)) { ECDSAerror(ERR_R_BN_LIB); goto err; } |