summaryrefslogtreecommitdiff
path: root/lib/libcrypto/bn
AgeCommit message (Collapse)Author
2019-06-17Make BN_num_bits_word() constant time.Theo Buehler
Previously, this function would leak the most significant word of its argument due to branching and memory access pattern. This patch is enough to fix the use of BN_num_bits() on RSA prime factors in the library. The diff is a simplified and more readable (but perhaps less efficient) version of https://github.com/openssl/openssl/commit/972c87df by Andy Polyakov and David Benjamin (pre license change). Consult that commit message for details. Subsequent fixes to follow in the near future. Issue pointed out by David Schrammel and Samuel Weiser as part of a larger report. tests & ok inoguchi, ok jsing
2019-03-23Add range checks to varios ASN1_INTEGER functions to ensure theBob Beck
sizes used remain a positive integer. Should address issue 13799 from oss-fuzz ok tb@ jsing@
2019-01-20Fix BN_is_prime_* calls in libcrypto, the API returns -1 on error.Theo Buehler
From BoringSSL's commit 53409ee3d7595ed37da472bc73b010cd2c8a5ffd by David Benjamin. ok djm, jsing
2018-11-06Flip reversed test in bn_rand_interval().Theo Buehler
ok jsing
2018-11-05Introduce bn_rand_interval() that allows specifying an interval [a, b)Theo Buehler
from which a a BIGNUM is chosen uniformly at random. ok beck jsing
2018-07-23Use a size_t instead of an int for the byte count in BN_swap_ct().Theo Buehler
Since bignums use ints for the same purpose, this still uses an int internally after an overflow check. Suggested by and discussed with jsing. ok inoguchi, jsing
2018-07-23Clean up our disgusting implementations of BN_{,u}{add,sub}(), followingTheo Buehler
changes made in OpenSSL by Davide Galassi and others, so that one can actually follow what is going on. There is no performance impact from this change as the code still does essentially the same thing. There's a ton of work still to be done to make the BN code less terrible. ok jsing, kn
2018-07-13Eliminate the weird condition in the BN_swap_ct() API that at most one bitTheo Buehler
be set in condition. This makes the constant time bit-twiddling a bit trickier, but it's not too bad. Thanks to halex for an extensive rubber ducking session over a non-spicy spicy tabouleh falafel.. ok jsing, kn
2018-07-11Sync commentkn
Makes it a tad easier to read through and compare with BN_swap_ct(). OK tb
2018-07-11Turn yesterday's optimistic ! in an XXX comment into a more cautious ?Theo Buehler
2018-07-10Provide BN_swap_ct(), a constant time function that conditionally swapsTheo Buehler
two bignums. It's saner and substantially less ugly than the existing public BN_constantime_swap() function and will be used in forthcoming work on constant time ECC code. From Billy Brumley and his team. Thanks! ok jsing
2018-06-10fix odd whitespaceTheo Buehler
2018-05-12Use explicit_bzero() rather than memset() when clearing a BIGNUM.Joel Sing
ok bcook@ tb@
2018-02-20Provide BN_GENCB_new(), BN_GENCB_free() and BN_GENCB_get_arg()Joel Sing
2018-02-20Provide BN_get_rfc2409_prime_*() and BN_get_rfc3526_prime_*().Joel Sing
2017-05-02use freezero() instead of memset/explicit_bzero + free. SubstantiallyTheo de Raadt
reduces conditional logic (-218, +82). MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH cache alignment calculation bn/bn_exp.c wasn'tt quite right. Two other tricky bits with ASN1_STRING_FLAG_NDEF and BN_FLG_STATIC_DATA where the condition cannot be collapsed completely. Passes regress. ok beck
2017-01-29Send the function codes from the error functions to the bit bucket,Bob Beck
as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
2017-01-25Construct a BN_gcd_nonct, based on BN_mod_inverse_no_branch, as suggestedBob Beck
by Alejandro Cabrera <aldaya@gmail.com> to avoid the possibility of a sidechannel timing attack during RSA private key generation. Modify BN_gcd to become not visible under LIBRESSL_INTERNAL and force the use of the _ct or _nonct versions of the function only within the library. ok jsing@
2017-01-21use BN_div_nonct where it is safe to do so.Bob Beck
ok guenther@
2017-01-21Add ct and nonct versions of BN_mod_inverse for internal useBob Beck
ok jsing@
2017-01-21Split out BN_div and BN_mod into ct and nonct versions for Internal use.Bob Beck
ok jsing@
2017-01-21Make explicit _ct and _nonct versions of bn_mod_exp funcitons thatBob Beck
matter for constant time, and make the public interface only used external to the library. This moves us to a model where the important things are constant time versions unless you ask for them not to be, rather than the opposite. I'll continue with this method by method. Add regress tests for same. ok jsing@
2017-01-21/usr/bin/unifdef -D MONT_MUL_MOD -D MONT_EXP_WORD -D RECP_MUL_MOD -m bn_exp.cBob Beck
with some style cleanup after. no binary change ok jsing@
2017-01-04Remove superfluous datatype that is 32 by default. Clang complainsPatrick Wildt
about it and it's ok to remove it. This only came up as our clang is targeted at armv7 which enables the NEON instructions. ok kettenis@
2016-12-21Explicitly export a list of symbols from libcrypto.Joel Sing
Move the "internal" BN functions from bn.h to bn_lcl.h and stop exporting the bn_* symbols. These are documented as only being intended for internal use, so why they were placed in a public header is beyond me... This hides 363 previously exported symbols, most of which exist in headers that are not installed and were never intended to be public. This also removes a few crusty old things that should have died long ago (like _ossl_old_des_read_pw). But don't worry... there are still 3451 symbols exported from the library. With input and testing from inoguchi@. ok beck@ inoguchi@
2016-11-08Reduce the ternary operator abusePhilip Guenther
ok miod@
2016-11-05Stop abusing the ternary operator to decide which function to call in aMiod Vallat
return statement. ok beck@ jsing@
2016-11-04Replace all uses of magic numbers when operating on OPENSSL_ia32_P[] byMiod Vallat
meaningful constants in a private header file, so that reviewers can actually get a chance to figure out what the code is attempting to do without knowing all cpuid bits. While there, turn it from an array of two 32-bit ints into a properly aligned 64-bit int. Use of OPENSSL_ia32_P is now restricted to the assembler parts. C code will now always use OPENSSL_cpu_caps() and check for the proper bits in the whole 64-bit word it returns. i386 tests and ok jsing@
2009-04-06import of OpenSSL 0.9.8kDamien Miller
2016-10-17If BN_div_word() fails (by returning (BN_ULONG)-1) or if the divisionPhilip Guenther
fails to reduce the input in the expected space then fail out instead of overflowing the allocated buffer. combines openssl commits 28a89639da50b1caed4ff3015508f23173bf3e49 and 3612ff6fcec0e3d1f2a598135fe12177c0419582 ok doug@ beck@
2016-09-04Less S390.Joel Sing
ok deraadt@
2016-09-04Less IA64.Joel Sing
ok deraadt@
2009-04-06import of OpenSSL 0.9.8kDamien Miller
2016-09-03switch to a constant-time gather procedure for amd64 mont5 asmBrent Cook
from OpenSSL commit 7f98aa7403a1244cf17d1aa489f5bb0f39bae431 CVE-2016-0702 ok beck@
2016-09-03add constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF.Brent Cook
Patch based on OpenSSL commit d7a854c055ff22fb7da80c3b0e7cb08d248591d0 "Performance penalty varies from platform to platform, and even key length. For rsa2048 sign it was observed to reach almost 10%." CVE-2016-0702 ok beck@
2016-09-03BN_mod_exp_mont_consttime: check for zero modulus.Brent Cook
Don't dereference d when top is zero. Original patch from OpenSSL commit d46e946d2603c64df6e1e4f9db0c70baaf1c4c03 ok jsing@
2016-09-02BN_mod_exp_mont_consttime: check for zero modulus.Brent Cook
Don't dereference d when top is zero. Original patch from OpenSSL commit d46e946d2603c64df6e1e4f9db0c70baaf1c4c03 ok jsing@
2016-08-31Avoid undefined-behavior right-shifting by a word-size # of bits.Brent Cook
Found with STACK, originally from OpenSSL, ok @beck
2016-07-18don't mix code and decls, ok tedu@Brent Cook
2016-07-17use memset to initialize the unionBrent Cook
2016-07-17Initialize buffers before use, noted by Kinichiro Inoguchi.Brent Cook
ok beck@
2016-07-05On systems where we do not have BN_ULLONG defined (most 64-bit systems),Brent Cook
BN_mod_word() can return incorrect results if the supplied modulus is too big, so we need to fall back to BN_div_word. Now that BN_mod_word may fail, handle errors properly update the man page. Thanks to Brian Smith for pointing out these fixes from BoringSSL: https://boringssl.googlesource.com/boringssl/+/67cb49d045f04973ddba0f92fe8a8ad483c7da89 https://boringssl.googlesource.com/boringssl/+/44bedc348d9491e63c7ed1438db100a4b8a830be ok beck@
2016-03-15'accomodate' -> 'accommodate' in comments.Kenneth R Westerback
Started by diff from Mical Mazurek.
2016-03-12Add error handling to the remaining calls to bn_wexpand().Brent Cook
Noticed by pascal-cuoq from Github: https://github.com/libressl-portable/openbsd/issues/56 ok beck@
2016-03-04graduate bn_expand() to a real function. the openssl version of thisTheo de Raadt
uses a macro with multiple-evaluations of arguments (different amount than the previous version..), but doug/bcook's inline version makes BIGNUM not opaque [problem spotted by naddy] ok doug
2016-03-04Revert bn_expand until there's consensus on a fix.Doug Hogan
2016-03-02Add bounds checking for BN_hex2bn/BN_dec2bn.Doug Hogan
Need to make sure i * 4 won't overflow. Based on OpenSSL: commit 99ba9fd02fd481eb971023a3a0a251a37eb87e4c input + ok bcook@ ok beck@
2015-12-24More adress -> addressMichael McConville
2015-11-06Fix gcc version preprocessor checks to cope with gcc 5.x and beyond;Miod Vallat
reported by Ruslan Babayev.
2015-10-21Reject too small bits value in BN_generate_prime_ex(), so that it does not riskMiod Vallat
becoming negative in probable_prime_dh_safe(). Reported by Franck Denis who noticed `openssl gendh 0' would segfault. Fix adapted from OpenSSL RT#2701. ok beck@ jsing@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-29 22:53:22 +0000