diff options
| author | Cesar Pereida Garcia <cesar.pereidagarcia@tut.fi> | 2019-09-05 12:13:11 +0300 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2019-09-06 16:11:27 +0100 |
| commit | 311e903d8468e2a380d371609a10eda71de16c0e (patch) | |
| tree | 735af77d22a8078830dd70b50119c3cfbb23fba8 /crypto/asn1 | |
| parent | c7bfb138acf6103ae6fd178eb212b110bfb39c0d (diff) | |
[crypto/asn1] Fix multiple SCA vulnerabilities during RSA key validation.
This commit addresses multiple side-channel vulnerabilities present
during RSA key validation.
Private key parameters are re-computed using variable-time functions.
This issue was discovered and reported by the NISEC group at TAU Finland.
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9779)
Diffstat (limited to 'crypto/asn1')
| -rw-r--r-- | crypto/asn1/x_bignum.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/crypto/asn1/x_bignum.c b/crypto/asn1/x_bignum.c index d7abca6c76..c5e892900e 100644 --- a/crypto/asn1/x_bignum.c +++ b/crypto/asn1/x_bignum.c @@ -130,9 +130,20 @@ static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, static int bn_secure_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it) { - if (!*pval) - bn_secure_new(pval, it); - return bn_c2i(pval, cont, len, utype, free_cont, it); + int ret; + BIGNUM *bn; + + if (!*pval && !bn_secure_new(pval, it)) + return 0; + + ret = bn_c2i(pval, cont, len, utype, free_cont, it); + if (!ret) + return 0; + + /* Set constant-time flag for all secure BIGNUMS */ + bn = (BIGNUM *)*pval; + BN_set_flags(bn, BN_FLG_CONSTTIME); + return ret; } static int bn_print(BIO *out, const ASN1_VALUE **pval, const ASN1_ITEM *it, |