diff options
| author |   jsing <jsing@openbsd.org> | 2018-02-14 16:27:24 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2018-02-14 16:27:24 +0000 |
| commit | 972cfb97c0f26482a8a8f451f15f5d63a9b391fc (patch) | |
| tree | 8d0bfdf950e4cbc1fb791931b051d461903df707 /usr.bin/ssh/ssh-rsa.c | |
| parent | Provide X509_get_signature_nid(). (diff) | |
| download | wireguard-openbsd-972cfb97c0f26482a8a8f451f15f5d63a9b391fc.tar.xz wireguard-openbsd-972cfb97c0f26482a8a8f451f15f5d63a9b391fc.zip | |
Ensure that D mod (P-1) and D mod (Q-1) are calculated in constant time.
This avoids a potential side channel timing leak.
ok djm@ markus@
Diffstat (limited to 'usr.bin/ssh/ssh-rsa.c')
| -rw-r--r-- | usr.bin/ssh/ssh-rsa.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/usr.bin/ssh/ssh-rsa.c b/usr.bin/ssh/ssh-rsa.c index d5054698ef3..006c8bdca40 100644 --- a/usr.bin/ssh/ssh-rsa.c +++ b/usr.bin/ssh/ssh-rsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-rsa.c,v 1.65 2018/02/07 05:17:56 jsing Exp $ */ +/* $OpenBSD: ssh-rsa.c,v 1.66 2018/02/14 16:27:24 jsing Exp $ */ /* * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org> * @@ -74,13 +74,12 @@ rsa_hash_alg_nid(int type) } } -/* calculate p-1 and q-1 */ int ssh_rsa_generate_additional_parameters(struct sshkey *key) { - RSA *rsa; BIGNUM *aux = NULL; BN_CTX *ctx = NULL; + BIGNUM d; int r; if (key == NULL || key->rsa == NULL || @@ -93,12 +92,15 @@ ssh_rsa_generate_additional_parameters(struct sshkey *key) r = SSH_ERR_ALLOC_FAIL; goto out; } - rsa = key->rsa; + BN_set_flags(aux, BN_FLG_CONSTTIME); - if ((BN_sub(aux, rsa->q, BN_value_one()) == 0) || - (BN_mod(rsa->dmq1, rsa->d, aux, ctx) == 0) || - (BN_sub(aux, rsa->p, BN_value_one()) == 0) || - (BN_mod(rsa->dmp1, rsa->d, aux, ctx) == 0)) { + BN_init(&d); + BN_with_flags(&d, key->rsa->d, BN_FLG_CONSTTIME); + + if ((BN_sub(aux, key->rsa->q, BN_value_one()) == 0) || + (BN_mod(key->rsa->dmq1, &d, aux, ctx) == 0) || + (BN_sub(aux, key->rsa->p, BN_value_one()) == 0) || + (BN_mod(key->rsa->dmp1, &d, aux, ctx) == 0)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } |