f68dd54569
CVE-2018-0739 CVE-2019-1563 CVE-2020-1971 CVE-2021-23840 CVE-2021-23841 CVE-2022-0778 CVE-2021-3712 (cherry picked from commit a582068887203f626772052e466343c6ef2d0719)
80 lines
2.8 KiB
Diff
80 lines
2.8 KiB
Diff
From 0b199a883e9170cdfe8e61c150bbaf8d8951f3e7 Mon Sep 17 00:00:00 2001
|
|
From: Samuel Weiser <samuel.weiser@iaik.tugraz.at>
|
|
Date: Tue, 5 Dec 2017 15:55:17 +0100
|
|
Subject: [PATCH] Replaced variable-time GCD with consttime inversion to avoid
|
|
side-channel attacks on RSA key generation
|
|
|
|
Reviewed-by: Rich Salz <rsalz@openssl.org>
|
|
Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
|
|
Reviewed-by: Matt Caswell <matt@openssl.org>
|
|
(Merged from https://github.com/openssl/openssl/pull/5170)
|
|
|
|
(cherry picked from commit 9db724cfede4ba7a3668bff533973ee70145ec07)
|
|
---
|
|
crypto/rsa/rsa_gen.c | 30 ++++++++++++++++++++++++------
|
|
1 file changed, 24 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/Cryptlib/OpenSSL/crypto/rsa/rsa_gen.c b/Cryptlib/OpenSSL/crypto/rsa/rsa_gen.c
|
|
index a85493d6097..8553772f062 100644
|
|
--- a/Cryptlib/OpenSSL/crypto/rsa/rsa_gen.c
|
|
+++ b/Cryptlib/OpenSSL/crypto/rsa/rsa_gen.c
|
|
@@ -109,6 +109,7 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
|
|
BIGNUM *pr0, *d, *p;
|
|
int bitsp, bitsq, ok = -1, n = 0;
|
|
BN_CTX *ctx = NULL;
|
|
+ unsigned long error = 0;
|
|
|
|
/*
|
|
* When generating ridiculously small keys, we can get stuck
|
|
@@ -155,16 +156,25 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
|
|
if (BN_copy(rsa->e, e_value) == NULL)
|
|
goto err;
|
|
|
|
+ BN_set_flags(rsa->e, BN_FLG_CONSTTIME);
|
|
/* generate p and q */
|
|
for (;;) {
|
|
if (!BN_generate_prime_ex(rsa->p, bitsp, 0, NULL, NULL, cb))
|
|
goto err;
|
|
if (!BN_sub(r2, rsa->p, BN_value_one()))
|
|
goto err;
|
|
- if (!BN_gcd(r1, r2, rsa->e, ctx))
|
|
- goto err;
|
|
- if (BN_is_one(r1))
|
|
+ if (BN_mod_inverse(r1, r2, rsa->e, ctx) != NULL) {
|
|
+ /* GCD == 1 since inverse exists */
|
|
break;
|
|
+ }
|
|
+ error = ERR_peek_last_error();
|
|
+ if (ERR_GET_LIB(error) == ERR_LIB_BN
|
|
+ && ERR_GET_REASON(error) == BN_R_NO_INVERSE) {
|
|
+ /* GCD != 1 */
|
|
+ ERR_clear_error();
|
|
+ } else {
|
|
+ goto err;
|
|
+ }
|
|
if (!BN_GENCB_call(cb, 2, n++))
|
|
goto err;
|
|
}
|
|
@@ -177,10 +187,18 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
|
|
} while (BN_cmp(rsa->p, rsa->q) == 0);
|
|
if (!BN_sub(r2, rsa->q, BN_value_one()))
|
|
goto err;
|
|
- if (!BN_gcd(r1, r2, rsa->e, ctx))
|
|
- goto err;
|
|
- if (BN_is_one(r1))
|
|
+ if (BN_mod_inverse(r1, r2, rsa->e, ctx) != NULL) {
|
|
+ /* GCD == 1 since inverse exists */
|
|
break;
|
|
+ }
|
|
+ error = ERR_peek_last_error();
|
|
+ if (ERR_GET_LIB(error) == ERR_LIB_BN
|
|
+ && ERR_GET_REASON(error) == BN_R_NO_INVERSE) {
|
|
+ /* GCD != 1 */
|
|
+ ERR_clear_error();
|
|
+ } else {
|
|
+ goto err;
|
|
+ }
|
|
if (!BN_GENCB_call(cb, 2, n++))
|
|
goto err;
|
|
}
|