From f667820c16a44245a4a898a568936c47a9b0ee6e Mon Sep 17 00:00:00 2001 From: Sohaib ul Hassan Date: Sat, 16 Jun 2018 17:07:40 +0300 Subject: Implement coordinate blinding for EC_POINT This commit implements coordinate blinding, i.e., it randomizes the representative of an elliptic curve point in its equivalence class, for prime curves implemented through EC_GFp_simple_method, EC_GFp_mont_method, and EC_GFp_nist_method. This commit is derived from the patch https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley. Coordinate blinding is a generally useful side-channel countermeasure and is (mostly) free. The function itself takes a few field multiplicationss, but is usually only necessary at the beginning of a scalar multiplication (as implemented in the patch). When used this way, it makes the values that variables take (i.e., field elements in an algorithm state) unpredictable. For instance, this mitigates chosen EC point side-channel attacks for settings such as ECDH and EC private key decryption, for the aforementioned curves. For EC_METHODs using different coordinate representations this commit does nothing, but the corresponding coordinate blinding function can be easily added in the future to extend these changes to such curves. Co-authored-by: Nicola Tuveri Co-authored-by: Billy Brumley Reviewed-by: Andy Polyakov Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/6501) --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'CHANGES') diff --git a/CHANGES b/CHANGES index fe3e13aa0d..a4beda66dd 100644 --- a/CHANGES +++ b/CHANGES @@ -8,6 +8,11 @@ release branch. Changes between 1.1.0h and 1.1.1 [xx XXX xxxx] + *) Add coordinate blinding for EC_POINT and implement projective + coordinate blinding for generic prime curves as a countermeasure to + chosen point SCA attacks. + [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley] + *) Add blinding to an ECDSA signature to protect against side channel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell] -- cgit v1.2.3