107d4586e6
- Added libica-sles15sp2-x25519-x448-fix-handling-of-non-canonical-values.patch (bsc#1156768) OBS-URL: https://build.opensuse.org/request/show/748777 OBS-URL: https://build.opensuse.org/package/show/devel:openSUSE:Factory/libica?expand=0&rev=40
132 lines
3.0 KiB
Diff
132 lines
3.0 KiB
Diff
From a3b36ef136e304a1e2dc12ef7b96686202cbd00d Mon Sep 17 00:00:00 2001
|
|
From: Patrick Steuer <patrick.steuer@de.ibm.com>
|
|
Date: Wed, 13 Nov 2019 17:12:43 +0100
|
|
Subject: [PATCH] x25519,x448: fix handling of non-canonical values
|
|
|
|
Reduce the peer public key's u-coordinate if it is >= p.
|
|
|
|
Signed-off-by: Patrick Steuer <patrick.steuer@de.ibm.com>
|
|
---
|
|
src/s390_ecc.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 91 insertions(+)
|
|
|
|
diff --git a/src/s390_ecc.c b/src/s390_ecc.c
|
|
index 7654959..62799ee 100644
|
|
--- a/src/s390_ecc.c
|
|
+++ b/src/s390_ecc.c
|
|
@@ -557,6 +557,91 @@ struct { \
|
|
return rc;
|
|
}
|
|
|
|
+/*
|
|
+ * mask must be 0xFF or 0x00.
|
|
+ * "constant time" is per len.
|
|
+ *
|
|
+ * if (mask) {
|
|
+ * unsigned char tmp[len];
|
|
+ *
|
|
+ * memcpy(tmp, a, len);
|
|
+ * memcpy(a, b);
|
|
+ * memcpy(b, tmp);
|
|
+ * }
|
|
+ */
|
|
+static inline void constant_time_cond_swap_buff(unsigned char mask,
|
|
+ unsigned char *a,
|
|
+ unsigned char *b,
|
|
+ size_t len)
|
|
+{
|
|
+ size_t i;
|
|
+ unsigned char tmp;
|
|
+
|
|
+ for (i = 0; i < len; i++) {
|
|
+ tmp = a[i] ^ b[i];
|
|
+ tmp &= mask;
|
|
+ a[i] ^= tmp;
|
|
+ b[i] ^= tmp;
|
|
+ }
|
|
+}
|
|
+
|
|
+
|
|
+static void s390_x25519_mod_p(unsigned char u[32])
|
|
+{
|
|
+ unsigned char u_red[32];
|
|
+ unsigned int c = 0;
|
|
+ int i;
|
|
+
|
|
+ memcpy(u_red, u, sizeof(u_red));
|
|
+
|
|
+ c += (unsigned int)u_red[31] + 19;
|
|
+ u_red[31] = (unsigned char)c;
|
|
+ c >>= 8;
|
|
+
|
|
+ for (i = 30; i >= 0; i--) {
|
|
+ c += (unsigned int)u_red[i];
|
|
+ u_red[i] = (unsigned char)c;
|
|
+ c >>= 8;
|
|
+ }
|
|
+
|
|
+ c = (u_red[0] & 0x80) >> 7;
|
|
+ u_red[0] &= 0x7f;
|
|
+ constant_time_cond_swap_buff(0 - (unsigned char)c,
|
|
+ u, u_red, sizeof(u_red));
|
|
+}
|
|
+
|
|
+static void s390_x448_mod_p(unsigned char u[56])
|
|
+{
|
|
+ unsigned char u_red[56];
|
|
+ unsigned int c = 0;
|
|
+ int i;
|
|
+
|
|
+ memcpy(u_red, u, sizeof(u_red));
|
|
+
|
|
+ c += (unsigned int)u_red[55] + 1;
|
|
+ u_red[55] = (unsigned char)c;
|
|
+ c >>= 8;
|
|
+
|
|
+ for (i = 54; i >= 28; i--) {
|
|
+ c += (unsigned int)u_red[i];
|
|
+ u_red[i] = (unsigned char)c;
|
|
+ c >>= 8;
|
|
+ }
|
|
+
|
|
+ c += (unsigned int)u_red[27] + 1;
|
|
+ u_red[27] = (unsigned char)c;
|
|
+ c >>= 8;
|
|
+
|
|
+ for (i = 26; i >= 0; i--) {
|
|
+ c += (unsigned int)u_red[i];
|
|
+ u_red[i] = (unsigned char)c;
|
|
+ c >>= 8;
|
|
+ }
|
|
+
|
|
+ constant_time_cond_swap_buff(0 - (unsigned char)c,
|
|
+ u, u_red, sizeof(u_red));
|
|
+}
|
|
+
|
|
int scalar_mulx_cpacf(unsigned char *res_u,
|
|
const unsigned char *scalar,
|
|
const unsigned char *u,
|
|
@@ -598,6 +683,9 @@ struct { \
|
|
s390_flip_endian_32(param.X25519.u, param.X25519.u);
|
|
s390_flip_endian_32(param.X25519.scalar, param.X25519.scalar);
|
|
|
|
+ /* reduce non-canonical values */
|
|
+ s390_x25519_mod_p(param.X25519.u);
|
|
+
|
|
fc = s390_pcc_functions[SCALAR_MULTIPLY_X25519].hw_fc;
|
|
rc = s390_pcc(fc, ¶m) ? EIO : 0;
|
|
|
|
@@ -619,6 +707,9 @@ struct { \
|
|
s390_flip_endian_64(param.X448.u, param.X448.u);
|
|
s390_flip_endian_64(param.X448.scalar, param.X448.scalar);
|
|
|
|
+ /* reduce non-canonical values */
|
|
+ s390_x448_mod_p(param.X448.u + 8);
|
|
+
|
|
fc = s390_pcc_functions[SCALAR_MULTIPLY_X448].hw_fc;
|
|
rc = s390_pcc(fc, ¶m) ? EIO : 0;
|
|
|
|
--
|
|
2.13.7
|
|
|