From 40e48e54582e46c1a01e184ecf5bd31f4f7f8294 Mon Sep 17 00:00:00 2001
From: Billy Brumley <bbrumley@gmail.com>
Date: Thu, 19 Apr 2018 12:21:51 +0300
Subject: Elliptic curve scalar multiplication with timing attack defenses

Co-authored-by: Nicola Tuveri <nic.tuv@gmail.com>
Co-authored-by: Cesar Pereida Garcia <cesar.pereidagarcia@tut.fi>
Co-authored-by: Sohaib ul Hassan <soh.19.hassan@gmail.com>

Reviewed-by: Andy Polyakov <appro@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6009)
---
 crypto/bn/bn_lib.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'crypto/bn/bn_lib.c')

diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index 57fe45288b..a446880ec7 100644
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -739,6 +739,19 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
     a->top ^= t;
     b->top ^= t;
 
+    t = (a->neg ^ b->neg) & condition;
+    a->neg ^= t;
+    b->neg ^= t;
+
+    /*
+     * cannot just arbitrarily swap flags.
+     * The way a->d is allocated etc.
+     * BN_FLG_MALLOCED, BN_FLG_STATIC_DATA, ...
+     */
+    t = (a->flags ^ b->flags) & condition & BN_FLG_CONSTTIME;
+    a->flags ^= t;
+    b->flags ^= t;
+
 #define BN_CONSTTIME_SWAP(ind) \
         do { \
                 t = (a->d[ind] ^ b->d[ind]) & condition; \
-- 
cgit v1.2.3