diff options
| author | jsing@openbsd.org <jsing@openbsd.org> | 2018-02-14 17:27:24 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2018-02-16 03:35:28 +0100 |
| commit | d2b3db2860c962927def39a52f67f1c23f7b201a (patch) | |
| tree | 3eee8977e69b87fa8c4d01f508daedfe7d4ed12c /ssh-rsa.c | |
| parent | upstream: Some obvious freezero() conversions. (diff) | |
| download | openssh-d2b3db2860c962927def39a52f67f1c23f7b201a.tar.xz openssh-d2b3db2860c962927def39a52f67f1c23f7b201a.zip | |
upstream: Ensure that D mod (P-1) and D mod (Q-1) are calculated in
constant time.
This avoids a potential side channel timing leak.
ok djm@ markus@
OpenBSD-Commit-ID: 71ff3c16be03290e63d8edab8fac053d8a82968c
Diffstat (limited to 'ssh-rsa.c')
| -rw-r--r-- | ssh-rsa.c | 18 |
1 files changed, 10 insertions, 8 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-rsa.c,v 1.65 2018/02/07 05:17:56 jsing Exp $ */ +/* $OpenBSD: ssh-rsa.c,v 1.66 2018/02/14 16:27:24 jsing Exp $ */ /* * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org> * @@ -79,13 +79,12 @@ rsa_hash_alg_nid(int type) } } -/* calculate p-1 and q-1 */ int ssh_rsa_generate_additional_parameters(struct sshkey *key) { - RSA *rsa; BIGNUM *aux = NULL; BN_CTX *ctx = NULL; + BIGNUM d; int r; if (key == NULL || key->rsa == NULL || @@ -98,12 +97,15 @@ ssh_rsa_generate_additional_parameters(struct sshkey *key) r = SSH_ERR_ALLOC_FAIL; goto out; } - rsa = key->rsa; + BN_set_flags(aux, BN_FLG_CONSTTIME); - if ((BN_sub(aux, rsa->q, BN_value_one()) == 0) || - (BN_mod(rsa->dmq1, rsa->d, aux, ctx) == 0) || - (BN_sub(aux, rsa->p, BN_value_one()) == 0) || - (BN_mod(rsa->dmp1, rsa->d, aux, ctx) == 0)) { + BN_init(&d); + BN_with_flags(&d, key->rsa->d, BN_FLG_CONSTTIME); + + if ((BN_sub(aux, key->rsa->q, BN_value_one()) == 0) || + (BN_mod(key->rsa->dmq1, &d, aux, ctx) == 0) || + (BN_sub(aux, key->rsa->p, BN_value_one()) == 0) || + (BN_mod(key->rsa->dmp1, &d, aux, ctx) == 0)) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } |