summaryrefslogtreecommitdiffstats
path: root/crypto/bn/bn_blind.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Copyright year updatesMatt Caswell2023-09-071-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
* Alternative fix for CVE-2022-4304Bernd Edlinger2023-04-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Revert "Fix Timing Oracle in RSA decryption"Bernd Edlinger2023-04-041-0/+14
| | | | | | | | | | This reverts commit b1892d21f8f0435deb0250f24a97915dc641c807. Except for the moving derive_kdk to a separate function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20281)
* Fix Timing Oracle in RSA decryptionDmitry Belyavskiy2023-02-071-14/+0
| | | | | | | | | | | | | | | | A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. Patch written by Dmitry Belyavsky and Hubert Kario CVE-2022-4304 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
* Stop raising ERR_R_MALLOC_FAILURE in most placesRichard Levitte2022-10-051-4/+2
| | | | | | | | | | | | | | | | | | | | | | | Since OPENSSL_malloc() and friends report ERR_R_MALLOC_FAILURE, and at least handle the file name and line number they are called from, there's no need to report ERR_R_MALLOC_FAILURE where they are called directly, or when SSLfatal() and RLAYERfatal() is used, the reason `ERR_R_MALLOC_FAILURE` is changed to `ERR_R_CRYPTO_LIB`. There were a number of places where `ERR_R_MALLOC_FAILURE` was reported even though it was a function from a different sub-system that was called. Those places are changed to report ERR_R_{lib}_LIB, where {lib} is the name of that sub-system. Some of them are tricky to get right, as we have a lot of functions that belong in the ASN1 sub-system, and all the `sk_` calls or from the CRYPTO sub-system. Some extra adaptation was necessary where there were custom OPENSSL_malloc() wrappers, and some bugs are fixed alongside these changes. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19301)
* Update copyright yearMatt Caswell2021-06-171-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15801)
* add zero strenght arguments to BN and RAND RNG callsPauli2021-05-291-1/+1
| | | | | Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15513)
* Update copyright yearMatt Caswell2020-11-261-1/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13533)
* Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte2020-11-131-6/+6
| | | | | | | | | | This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
* Reorganize local header filesDr. Matthias St. Pierre2019-09-281-1/+1
| | | | | | | | | | | | | Apart from public and internal header files, there is a third type called local header files, which are located next to source files in the source directory. Currently, they have different suffixes like '*_lcl.h', '*_local.h', or '*_int.h' This commit changes the different suffixes to '*_local.h' uniformly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9333)
* Make sure all BIGNUM operations work within the FIPS providerMatt Caswell2019-07-151-1/+1
| | | | | | | | | | | The FIPS provider does not have a default OPENSSL_CTX so, where necessary, we need to ensure we can always access an explicit OPENSSL_CTX. We remove functions from the FIPS provider that use the default OPENSSL_CTX, and fixup some places which were using those removed functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9310)
* Following the license change, modify the boilerplates in crypto/bn/Richard Levitte2018-12-061-1/+1
| | | | | | | [skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7777)
* bn/bn_blind.c: use Montgomery multiplication when possible.Andy Polyakov2018-08-231-32/+56
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/6915)
* Update copyright yearMatt Caswell2018-04-031-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5851)
* Use the private RNG for data that is not publicKurt Roeckx2018-04-021-1/+1
| | | | | | | | Reviewed-by: Dr. Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Rich Salz <rsalz@openssl.org> Fixes: #4641 GH: #4665
* Allow NULL for some _free routines.Rich Salz2018-03-271-0/+2
| | | | | | | | | | Based on the description in https://github.com/openssl/openssl/pull/5757, this re-implements the "allow NULL to be passed" behavior of a number of xxx_free routines. I also fixed up some egregious formatting errors that were nearby. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5761)
* Remove some code for a contributor that we cannot findMatt Caswell2018-03-271-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This removes some code because we cannot trace the original contributor to get their agreement for the licence change (original commit e03ddfae). After this change there will be numerous failures in the test cases until someone rewrites the missing code. All *_free functions should accept a NULL parameter. After this change the following *_free functions will fail if a NULL parameter is passed: BIO_ACCEPT_free() BIO_CONNECT_free() BN_BLINDING_free() BN_CTX_free() BN_MONT_CTX_free() BN_RECP_CTX_free() BUF_MEM_free() COMP_CTX_free() ERR_STATE_free() TXT_DB_free() X509_STORE_free() ssl3_free() ssl_cert_free() SSL_SESSION_free() SSL_free() [skip ci] Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/5757)
* Remove parentheses of return.KaoruToda2017-10-181-5/+5
| | | | | | | | | Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
* Copyright consolidation 06/10Rich Salz2016-05-171-107/+6
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fold threads.h into crypto.h making API publicViktor Dukhovni2016-05-161-1/+0
| | | | | | Document thread-safe lock creation Reviewed-by: Richard Levitte <levitte@openssl.org>
* Convert RSA blinding to new multi-threading APIAlessandro Ghedini2016-03-091-17/+32
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove /* foo.c */ commentsRich Salz2016-01-261-1/+0
| | | | | | | | | | | | This was done by the following find . -name '*.[ch]' | /tmp/pl where /tmp/pl is the following three-line script: print unless $. == 1 && m@/\* .*\.[ch] \*/@; close ARGV if eof; # Close file to reset $. And then some hand-editing of other files. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Backwards-compatibility subject to OPENSSL_API_COMPATViktor Dukhovni2016-01-081-2/+3
| | | | | | | | | Provide backwards-compatiblity for functions, macros and include files if OPENSSL_API_COMPAT is either not defined or defined less than the version number of the release in which the feature was deprecated. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add and use OPENSSL_zallocRich Salz2015-09-031-2/+1
| | | | | | | | | There are many places (nearly 50) where we malloc and then memset. Add an OPENSSL_zalloc routine to encapsulate that. (Missed one conversion; thanks Richard) Also fixes GH328 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Identify and move common internal libcrypto header filesRichard Levitte2015-05-141-1/+1
| | | | | | | | | | | | | There are header files in crypto/ that are used by a number of crypto/ submodules. Move those to crypto/include/internal and adapt the affected source code and Makefiles. The header files that got moved are: crypto/cryptolib.h crypto/md32_common.h Reviewed-by: Rich Salz <rsalz@openssl.org>
* memset, memcpy, sizeof consistency fixesRich Salz2015-05-061-1/+1
| | | | | | | | Just as with the OPENSSL_malloc calls, consistently use sizeof(*ptr) for memset and memcpy. Remove needless casts for those functions. For memset, replace alternative forms of zero with 0. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Use safer sizeof variant in mallocRich Salz2015-05-041-1/+1
| | | | | | | | | | | | | For a local variable: TYPE *p; Allocations like this are "risky": p = OPENSSL_malloc(sizeof(TYPE)); if the type of p changes, and the malloc call isn't updated, you could get memory corruption. Instead do this: p = OPENSSL_malloc(sizeof(*p)); Also fixed a few memset() calls that I noticed while doing this. Reviewed-by: Richard Levitte <levitte@openssl.org>
* free NULL cleanup 7Rich Salz2015-05-011-13/+7
| | | | | | | | | | | This gets BN_.*free: BN_BLINDING_free BN_CTX_free BN_FLG_FREE BN_GENCB_free BN_MONT_CTX_free BN_RECP_CTX_free BN_clear_free BN_free BUF_MEM_free Also fix a call to DSA_SIG_free to ccgost engine and remove some #ifdef'd dead code in engines/e_ubsec. Reviewed-by: Richard Levitte <levitte@openssl.org>
* remove malloc castsRich Salz2015-04-281-1/+1
| | | | | | | Following ANSI C rules, remove the casts from calls to OPENSSL_malloc and OPENSSL_realloc. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Run util/openssl-format-source -v -c .Matt Caswell2015-01-221-242/+240
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* remove OPENSSL_FIPSAPIDr. Stephen Henson2014-12-081-1/+1
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* RT2163: Remove some unneeded #include'sDoug Goldstein2014-08-181-1/+0
| | | | | | | Several files #include stdio.h and don't need it. Also, per tjh, remove BN_COUNT Reviewed-by: Emilia Kasper <emilia@openssl.org>
* BN_BLINDING multi-threading fix.Bodo Möller2011-10-191-14/+23
| | | | Submitted by: Emilia Kasper (Google)
* Move all FIPSAPI renames into fips.h header file, include early inDr. Stephen Henson2011-01-271-6/+2
| | | | | | crypto.h if needed. Modify source tree to handle change.
* Redirect FIPS memory allocation to FIPS_malloc() routine, removeDr. Stephen Henson2011-01-271-0/+6
| | | | OpenSSL malloc dependencies.
* Internal version of BN_mod_inverse allowing checking of no-inverse withoutDr. Stephen Henson2011-01-261-4/+3
| | | | need to inspect error queue.
* Remove the dual-callback scheme for numeric and pointer thread IDs,Geoff Thorpe2008-08-061-9/+8
| | | | | | | | | deprecate the original (numeric-only) scheme, and replace with the CRYPTO_THREADID object. This hides the platform-specifics and should reduce the possibility for programming errors (where failing to explicitly check both thread ID forms could create subtle, platform-specific bugs). Thanks to Bodo, for invaluable review and feedback.
* Revert my earlier CRYPTO_THREADID commit, I will commit a reworkedGeoff Thorpe2008-07-031-11/+6
| | | | version some time soon.
* There was a need to support thread ID types that couldn't be reliably castGeoff Thorpe2008-03-281-6/+11
| | | | | | | | | | | | | | to 'unsigned long' (ie. odd platforms/compilers), so a pointer-typed version was added but it required portable code to check *both* modes to determine equality. This commit maintains the availability of both thread ID types, but deprecates the type-specific accessor APIs that invoke the callbacks - instead a single type-independent API is used. This simplifies software that calls into this interface, and should also make it less error-prone - as forgetting to call and compare *both* thread ID accessors could have led to hard-to-debug/infrequent bugs (that might only affect certain platforms or thread implementations). As the CHANGES note says, there were corresponding deprecations and replacements in the thread-related functions for BN_BLINDING and ERR too.
* Change to mitigate branch prediction attacksBodo Möller2007-03-281-1/+7
| | | | | Submitted by: Matthew D Wood Reviewed by: Bodo Moeller
* New functions CRYPTO_set_idptr_callback(),Bodo Möller2006-06-231-1/+13
| | | | | | CRYPTO_get_idptr_callback(), CRYPTO_thread_idptr() for a 'void *' type thread ID, since the 'unsigned long' type of the existing thread ID does not always work well.
* check BN_copy() return valueBodo Möller2005-05-261-3/+8
|
* Fix more error codes.Bodo Möller2005-05-111-2/+2
| | | | | (Also improve util/ck_errf.pl script, and occasionally fix source code formatting.)
* Stop unused variable warning.Dr. Stephen Henson2005-04-271-1/+0
|
* some updates for the blinding code; summary:Nils Larsch2005-04-271-12/+222
| | | | | | | | | | | - possibility of re-creation of the blinding parameters after a fixed number of uses (suggested by Bodo) - calculatition of the rsa::e in case it's absent and p and q are present (see bug report #785) - improve the performance when if one rsa structure is shared by more than a thread (see bug report #555) - fix the problem described in bug report #827 - hide the definition ot the BN_BLINDING structure in bn_blind.c
* Put the first stage of my bignum debugging adventures into CVS. This codeGeoff Thorpe2003-11-041-0/+1
| | | | | | is itself experimental, and in addition may cause execution to break on existing openssl "bugs" that previously were harmless or at least invisible.
* There have been a number of complaints from a number of sources that namesRichard Levitte2000-06-021-2/+2
| | | | | | | | | like Malloc, Realloc and especially Free conflict with already existing names on some operating systems or other packages. That is reason enough to change the names of the OpenSSL memory allocation macros to something that has a better chance of being unique, like prepending them with OPENSSL_. This change includes all the name changes needed throughout all C files.
* Change functions to ANSI C.Ulf Möller1999-04-191-17/+5
|
* Fix typos in error codes.Ulf Möller1999-04-191-3/+3
|
* Accept NULL in *_free.Ben Laurie1999-01-071-0/+3
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-30 20:35:39 +0100