diff options
| author | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2019-06-21 21:26:19 +0200 |
|---|---|---|
| committer | Bernd Edlinger <bernd.edlinger@hotmail.de> | 2019-07-19 20:45:25 +0200 |
| commit | aa8b244e5c22193078e3e80fad1f5b27bf62c73b (patch) | |
| tree | 3dbd85435ca315ab0c7141d42d33ea2da914ada7 | |
| parent | 7a7afc559ebc0ad88390cc62bfc34c221d595831 (diff) | |
Add value_barriers in constant time select functions
The barriers prevent the compiler from narrowing down the
possible value range of the mask and ~mask in the select
statements, which avoids the recognition of the select
and turning it into a conditional load or branch.
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/9419)
| -rw-r--r-- | crypto/constant_time_locl.h | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/crypto/constant_time_locl.h b/crypto/constant_time_locl.h index a5734f2fec..94e20bcfc8 100644 --- a/crypto/constant_time_locl.h +++ b/crypto/constant_time_locl.h @@ -185,11 +185,29 @@ static inline unsigned char constant_time_eq_int_8(int a, int b) return constant_time_eq_8((unsigned)(a), (unsigned)(b)); } +/* + * Returns the value unmodified, but avoids optimizations. + * The barriers prevent the compiler from narrowing down the + * possible value range of the mask and ~mask in the select + * statements, which avoids the recognition of the select + * and turning it into a conditional load or branch. + */ +static inline unsigned int value_barrier(unsigned int a) +{ +#if !defined(OPENSSL_NO_ASM) && defined(__GNUC__) + unsigned int r; + __asm__("" : "=r"(r) : "0"(a)); +#else + volatile unsigned int r = a; +#endif + return r; +} + static inline unsigned int constant_time_select(unsigned int mask, unsigned int a, unsigned int b) { - return (mask & a) | (~mask & b); + return (value_barrier(mask) & a) | (value_barrier(~mask) & b); } static inline unsigned char constant_time_select_8(unsigned char mask, |