From d7d1bdcb6aa3d5000bf7f5ebc5518be5c91fd5a5 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Thu, 11 Apr 2024 13:10:09 +0200 Subject: Make BN_generate_dsa_nonce() constant time and non-biased Co-authored-by: Paul Dale Reviewed-by: Paul Dale Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/24265) --- include/internal/constant_time.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'include') diff --git a/include/internal/constant_time.h b/include/internal/constant_time.h index 0ed6f823c1..e8244cd57b 100644 --- a/include/internal/constant_time.h +++ b/include/internal/constant_time.h @@ -140,6 +140,18 @@ static ossl_inline uint64_t constant_time_lt_64(uint64_t a, uint64_t b) return constant_time_msb_64(a ^ ((a ^ b) | ((a - b) ^ b))); } +#ifdef BN_ULONG +static ossl_inline BN_ULONG constant_time_msb_bn(BN_ULONG a) +{ + return 0 - (a >> (sizeof(a) * 8 - 1)); +} + +static ossl_inline BN_ULONG constant_time_lt_bn(BN_ULONG a, BN_ULONG b) +{ + return constant_time_msb_bn(a ^ ((a ^ b) | ((a - b) ^ b))); +} +#endif + static ossl_inline unsigned int constant_time_ge(unsigned int a, unsigned int b) { -- cgit v1.2.3