pool/openssl-1_1
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
ffdf279f1f
openssl-1_1/openssl-1_1-CVE-2019-1551.patch
Tomáš Chvátal 2e0a10cc4c Accepting request 755640 from home:pmonrealgonzalez:branches:security:tls 
- Security fix: [bsc#1158809, CVE-2019-1551]
  * Overflow bug in the x64_64 Montgomery squaring procedure used
    in exponentiation with 512-bit moduli
- Add openssl-1_1-CVE-2019-1551.patch

OBS-URL: https://build.opensuse.org/request/show/755640
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=47
2019-12-11 07:08:38 +00:00

1059 lines
29 KiB
Diff
Raw Blame History

From 419102400a2811582a7a3d4a4e317d72e5ce0a8f Mon Sep 17 00:00:00 2001
From: Andy Polyakov <appro@openssl.org>
Date: Wed, 4 Dec 2019 12:48:21 +0100
Subject: [PATCH 06/10] Fix an overflow bug in rsaz_512_sqr
There is an overflow bug in the x64_64 Montgomery squaring procedure used in
exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis
suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a
result of this defect would be very difficult to perform and are not believed
likely. Attacks against DH512 are considered just feasible. However, for an
attack the target would have to re-use the DH512 private key, which is not
recommended anyway. Also applications directly using the low level API
BN_mod_exp may be affected if they use BN_FLG_CONSTTIME.
CVE-2019-1551
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/10575)
---
crypto/bn/asm/rsaz-x86_64.pl | 381 ++++++++++++++++++-----------------
1 file changed, 197 insertions(+), 184 deletions(-)
Index: openssl-1.1.1d/crypto/bn/asm/rsaz-x86_64.pl
===================================================================
--- openssl-1.1.1d.orig/crypto/bn/asm/rsaz-x86_64.pl
+++ openssl-1.1.1d/crypto/bn/asm/rsaz-x86_64.pl
@@ -116,7 +116,7 @@ rsaz_512_sqr: # 25-29% faster than rs
subq \$128+24, %rsp
.cfi_adjust_cfa_offset 128+24
.Lsqr_body:
- movq $mod, %rbp # common argument
+ movq $mod, %xmm1 # common off-load
movq ($inp), %rdx
movq 8($inp), %rax
movq $n0, 128(%rsp)
@@ -134,7 +134,8 @@ $code.=<<___;
.Loop_sqr:
movl $times,128+8(%rsp)
#first iteration
- movq %rdx, %rbx
+ movq %rdx, %rbx # 0($inp)
+ mov %rax, %rbp # 8($inp)
mulq %rdx
movq %rax, %r8
movq 16($inp), %rax
@@ -173,31 +174,29 @@ $code.=<<___;
mulq %rbx
addq %rax, %r14
movq %rbx, %rax
- movq %rdx, %r15
- adcq \$0, %r15
+ adcq \$0, %rdx
- addq %r8, %r8 #shlq \$1, %r8
- movq %r9, %rcx
- adcq %r9, %r9 #shld \$1, %r8, %r9
+ xorq %rcx,%rcx # rcx:r8 = r8 << 1
+ addq %r8, %r8
+ movq %rdx, %r15
+ adcq \$0, %rcx
mulq %rax
- movq %rax, (%rsp)
- addq %rdx, %r8
- adcq \$0, %r9
+ addq %r8, %rdx
+ adcq \$0, %rcx
- movq %r8, 8(%rsp)
- shrq \$63, %rcx
+ movq %rax, (%rsp)
+ movq %rdx, 8(%rsp)
#second iteration
- movq 8($inp), %r8
movq 16($inp), %rax
- mulq %r8
+ mulq %rbp
addq %rax, %r10
movq 24($inp), %rax
movq %rdx, %rbx
adcq \$0, %rbx
- mulq %r8
+ mulq %rbp
addq %rax, %r11
movq 32($inp), %rax
adcq \$0, %rdx
@@ -205,7 +204,7 @@ $code.=<<___;
movq %rdx, %rbx
adcq \$0, %rbx
- mulq %r8
+ mulq %rbp
addq %rax, %r12
movq 40($inp), %rax
adcq \$0, %rdx
@@ -213,7 +212,7 @@ $code.=<<___;
movq %rdx, %rbx
adcq \$0, %rbx
- mulq %r8
+ mulq %rbp
addq %rax, %r13
movq 48($inp), %rax
adcq \$0, %rdx
@@ -221,7 +220,7 @@ $code.=<<___;
movq %rdx, %rbx
adcq \$0, %rbx
- mulq %r8
+ mulq %rbp
addq %rax, %r14
movq 56($inp), %rax
adcq \$0, %rdx
@@ -229,39 +228,39 @@ $code.=<<___;
movq %rdx, %rbx
adcq \$0, %rbx
- mulq %r8
+ mulq %rbp
addq %rax, %r15
- movq %r8, %rax
+ movq %rbp, %rax
adcq \$0, %rdx
addq %rbx, %r15
- movq %rdx, %r8
- movq %r10, %rdx
- adcq \$0, %r8
-
- add %rdx, %rdx
- lea (%rcx,%r10,2), %r10 #shld \$1, %rcx, %r10
- movq %r11, %rbx
- adcq %r11, %r11 #shld \$1, %r10, %r11
+ adcq \$0, %rdx
+
+ xorq %rbx, %rbx # rbx:r10:r9 = r10:r9 << 1
+ addq %r9, %r9
+ movq %rdx, %r8
+ adcq %r10, %r10
+ adcq \$0, %rbx
mulq %rax
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rcx, %rax
+ movq 16($inp), %rbp
addq %rax, %r9
+ movq 24($inp), %rax
adcq %rdx, %r10
- adcq \$0, %r11
+ adcq \$0, %rbx
movq %r9, 16(%rsp)
movq %r10, 24(%rsp)
- shrq \$63, %rbx
#third iteration
- movq 16($inp), %r9
- movq 24($inp), %rax
- mulq %r9
+ mulq %rbp
addq %rax, %r12
movq 32($inp), %rax
movq %rdx, %rcx
adcq \$0, %rcx
- mulq %r9
+ mulq %rbp
addq %rax, %r13
movq 40($inp), %rax
adcq \$0, %rdx
@@ -269,7 +268,7 @@ $code.=<<___;
movq %rdx, %rcx
adcq \$0, %rcx
- mulq %r9
+ mulq %rbp
addq %rax, %r14
movq 48($inp), %rax
adcq \$0, %rdx
@@ -277,9 +276,7 @@ $code.=<<___;
movq %rdx, %rcx
adcq \$0, %rcx
- mulq %r9
- movq %r12, %r10
- lea (%rbx,%r12,2), %r12 #shld \$1, %rbx, %r12
+ mulq %rbp
addq %rax, %r15
movq 56($inp), %rax
adcq \$0, %rdx
@@ -287,36 +284,40 @@ $code.=<<___;
movq %rdx, %rcx
adcq \$0, %rcx
- mulq %r9
- shrq \$63, %r10
+ mulq %rbp
addq %rax, %r8
- movq %r9, %rax
+ movq %rbp, %rax
adcq \$0, %rdx
addq %rcx, %r8
- movq %rdx, %r9
- adcq \$0, %r9
+ adcq \$0, %rdx
- movq %r13, %rcx
- leaq (%r10,%r13,2), %r13 #shld \$1, %r12, %r13
+ xorq %rcx, %rcx # rcx:r12:r11 = r12:r11 << 1
+ addq %r11, %r11
+ movq %rdx, %r9
+ adcq %r12, %r12
+ adcq \$0, %rcx
mulq %rax
+ # rbx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rbx, %rax
+ movq 24($inp), %r10
addq %rax, %r11
+ movq 32($inp), %rax
adcq %rdx, %r12
- adcq \$0, %r13
+ adcq \$0, %rcx
movq %r11, 32(%rsp)
movq %r12, 40(%rsp)
- shrq \$63, %rcx
#fourth iteration
- movq 24($inp), %r10
- movq 32($inp), %rax
+ mov %rax, %r11 # 32($inp)
mulq %r10
addq %rax, %r14
movq 40($inp), %rax
movq %rdx, %rbx
adcq \$0, %rbx
+ mov %rax, %r12 # 40($inp)
mulq %r10
addq %rax, %r15
movq 48($inp), %rax
@@ -325,9 +326,8 @@ $code.=<<___;
movq %rdx, %rbx
adcq \$0, %rbx
+ mov %rax, %rbp # 48($inp)
mulq %r10
- movq %r14, %r12
- leaq (%rcx,%r14,2), %r14 #shld \$1, %rcx, %r14
addq %rax, %r8
movq 56($inp), %rax
adcq \$0, %rdx
@@ -336,32 +336,33 @@ $code.=<<___;
adcq \$0, %rbx
mulq %r10
- shrq \$63, %r12
addq %rax, %r9
movq %r10, %rax
adcq \$0, %rdx
addq %rbx, %r9
- movq %rdx, %r10
- adcq \$0, %r10
+ adcq \$0, %rdx
- movq %r15, %rbx
- leaq (%r12,%r15,2),%r15 #shld \$1, %r14, %r15
+ xorq %rbx, %rbx # rbx:r13:r14 = r13:r14 << 1
+ addq %r13, %r13
+ movq %rdx, %r10
+ adcq %r14, %r14
+ adcq \$0, %rbx
mulq %rax
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rcx, %rax
addq %rax, %r13
+ movq %r12, %rax # 40($inp)
adcq %rdx, %r14
- adcq \$0, %r15
+ adcq \$0, %rbx
movq %r13, 48(%rsp)
movq %r14, 56(%rsp)
- shrq \$63, %rbx
#fifth iteration
- movq 32($inp), %r11
- movq 40($inp), %rax
mulq %r11
addq %rax, %r8
- movq 48($inp), %rax
+ movq %rbp, %rax # 48($inp)
movq %rdx, %rcx
adcq \$0, %rcx
@@ -369,97 +370,99 @@ $code.=<<___;
addq %rax, %r9
movq 56($inp), %rax
adcq \$0, %rdx
- movq %r8, %r12
- leaq (%rbx,%r8,2), %r8 #shld \$1, %rbx, %r8
addq %rcx, %r9
movq %rdx, %rcx
adcq \$0, %rcx
+ mov %rax, %r14 # 56($inp)
mulq %r11
- shrq \$63, %r12
addq %rax, %r10
movq %r11, %rax
adcq \$0, %rdx
addq %rcx, %r10
- movq %rdx, %r11
- adcq \$0, %r11
+ adcq \$0, %rdx
- movq %r9, %rcx
- leaq (%r12,%r9,2), %r9 #shld \$1, %r8, %r9
+ xorq %rcx, %rcx # rcx:r8:r15 = r8:r15 << 1
+ addq %r15, %r15
+ movq %rdx, %r11
+ adcq %r8, %r8
+ adcq \$0, %rcx
mulq %rax
+ # rbx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rbx, %rax
addq %rax, %r15
+ movq %rbp, %rax # 48($inp)
adcq %rdx, %r8
- adcq \$0, %r9
+ adcq \$0, %rcx
movq %r15, 64(%rsp)
movq %r8, 72(%rsp)
- shrq \$63, %rcx
#sixth iteration
- movq 40($inp), %r12
- movq 48($inp), %rax
mulq %r12
addq %rax, %r10
- movq 56($inp), %rax
+ movq %r14, %rax # 56($inp)
movq %rdx, %rbx
adcq \$0, %rbx
mulq %r12
addq %rax, %r11
movq %r12, %rax
- movq %r10, %r15
- leaq (%rcx,%r10,2), %r10 #shld \$1, %rcx, %r10
adcq \$0, %rdx
- shrq \$63, %r15
addq %rbx, %r11
- movq %rdx, %r12
- adcq \$0, %r12
+ adcq \$0, %rdx
- movq %r11, %rbx
- leaq (%r15,%r11,2), %r11 #shld \$1, %r10, %r11
+ xorq %rbx, %rbx # rbx:r10:r9 = r10:r9 << 1
+ addq %r9, %r9
+ movq %rdx, %r12
+ adcq %r10, %r10
+ adcq \$0, %rbx
mulq %rax
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rcx, %rax
addq %rax, %r9
+ movq %r14, %rax # 56($inp)
adcq %rdx, %r10
- adcq \$0, %r11
+ adcq \$0, %rbx
movq %r9, 80(%rsp)
movq %r10, 88(%rsp)
#seventh iteration
- movq 48($inp), %r13
- movq 56($inp), %rax
- mulq %r13
+ mulq %rbp
addq %rax, %r12
- movq %r13, %rax
- movq %rdx, %r13
- adcq \$0, %r13
+ movq %rbp, %rax
+ adcq \$0, %rdx
- xorq %r14, %r14
- shlq \$1, %rbx
- adcq %r12, %r12 #shld \$1, %rbx, %r12
- adcq %r13, %r13 #shld \$1, %r12, %r13
- adcq %r14, %r14 #shld \$1, %r13, %r14
+ xorq %rcx, %rcx # rcx:r12:r11 = r12:r11 << 1
+ addq %r11, %r11
+ movq %rdx, %r13
+ adcq %r12, %r12
+ adcq \$0, %rcx
mulq %rax
+ # rbx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rbx, %rax
addq %rax, %r11
+ movq %r14, %rax # 56($inp)
adcq %rdx, %r12
- adcq \$0, %r13
+ adcq \$0, %rcx
movq %r11, 96(%rsp)
movq %r12, 104(%rsp)
#eighth iteration
- movq 56($inp), %rax
- mulq %rax
- addq %rax, %r13
- adcq \$0, %rdx
-
- addq %rdx, %r14
+ xorq %rbx, %rbx # rbx:r13 = r13 << 1
+ addq %r13, %r13
+ adcq \$0, %rbx
- movq %r13, 112(%rsp)
- movq %r14, 120(%rsp)
+ mulq %rax
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ addq %rcx, %rax
+ addq %r13, %rax
+ adcq %rbx, %rdx
movq (%rsp), %r8
movq 8(%rsp), %r9
@@ -469,6 +472,10 @@ $code.=<<___;
movq 40(%rsp), %r13
movq 48(%rsp), %r14
movq 56(%rsp), %r15
+ movq %xmm1, %rbp
+
+ movq %rax, 112(%rsp)
+ movq %rdx, 120(%rsp)
call __rsaz_512_reduce
@@ -500,9 +507,9 @@ $code.=<<___;
.Loop_sqrx:
movl $times,128+8(%rsp)
movq $out, %xmm0 # off-load
- movq %rbp, %xmm1 # off-load
#first iteration
mulx %rax, %r8, %r9
+ mov %rax, %rbx
mulx 16($inp), %rcx, %r10
xor %rbp, %rbp # cf=0, of=0
@@ -510,40 +517,39 @@ $code.=<<___;
mulx 24($inp), %rax, %r11
adcx %rcx, %r9
- mulx 32($inp), %rcx, %r12
+ .byte 0xc4,0x62,0xf3,0xf6,0xa6,0x20,0x00,0x00,0x00 # mulx 32($inp), %rcx, %r12
adcx %rax, %r10
- mulx 40($inp), %rax, %r13
+ .byte 0xc4,0x62,0xfb,0xf6,0xae,0x28,0x00,0x00,0x00 # mulx 40($inp), %rax, %r13
adcx %rcx, %r11
- .byte 0xc4,0x62,0xf3,0xf6,0xb6,0x30,0x00,0x00,0x00 # mulx 48($inp), %rcx, %r14
+ mulx 48($inp), %rcx, %r14
adcx %rax, %r12
adcx %rcx, %r13
- .byte 0xc4,0x62,0xfb,0xf6,0xbe,0x38,0x00,0x00,0x00 # mulx 56($inp), %rax, %r15
+ mulx 56($inp), %rax, %r15
adcx %rax, %r14
adcx %rbp, %r15 # %rbp is 0
- mov %r9, %rcx
- shld \$1, %r8, %r9
- shl \$1, %r8
-
- xor %ebp, %ebp
- mulx %rdx, %rax, %rdx
- adcx %rdx, %r8
- mov 8($inp), %rdx
- adcx %rbp, %r9
+ mulx %rdx, %rax, $out
+ mov %rbx, %rdx # 8($inp)
+ xor %rcx, %rcx
+ adox %r8, %r8
+ adcx $out, %r8
+ adox %rbp, %rcx
+ adcx %rbp, %rcx
mov %rax, (%rsp)
mov %r8, 8(%rsp)
#second iteration
- mulx 16($inp), %rax, %rbx
+ .byte 0xc4,0xe2,0xfb,0xf6,0x9e,0x10,0x00,0x00,0x00 # mulx 16($inp), %rax, %rbx
adox %rax, %r10
adcx %rbx, %r11
- .byte 0xc4,0x62,0xc3,0xf6,0x86,0x18,0x00,0x00,0x00 # mulx 24($inp), $out, %r8
+ mulx 24($inp), $out, %r8
adox $out, %r11
+ .byte 0x66
adcx %r8, %r12
mulx 32($inp), %rax, %rbx
@@ -561,24 +567,25 @@ $code.=<<___;
.byte 0xc4,0x62,0xc3,0xf6,0x86,0x38,0x00,0x00,0x00 # mulx 56($inp), $out, %r8
adox $out, %r15
adcx %rbp, %r8
+ mulx %rdx, %rax, $out
adox %rbp, %r8
+ .byte 0x48,0x8b,0x96,0x10,0x00,0x00,0x00 # mov 16($inp), %rdx
- mov %r11, %rbx
- shld \$1, %r10, %r11
- shld \$1, %rcx, %r10
-
- xor %ebp,%ebp
- mulx %rdx, %rax, %rcx
- mov 16($inp), %rdx
+ xor %rbx, %rbx
+ adox %r9, %r9
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rcx, %rax
+ adox %r10, %r10
adcx %rax, %r9
- adcx %rcx, %r10
- adcx %rbp, %r11
+ adox %rbp, %rbx
+ adcx $out, %r10
+ adcx %rbp, %rbx
mov %r9, 16(%rsp)
.byte 0x4c,0x89,0x94,0x24,0x18,0x00,0x00,0x00 # mov %r10, 24(%rsp)
#third iteration
- .byte 0xc4,0x62,0xc3,0xf6,0x8e,0x18,0x00,0x00,0x00 # mulx 24($inp), $out, %r9
+ mulx 24($inp), $out, %r9
adox $out, %r12
adcx %r9, %r13
@@ -586,7 +593,7 @@ $code.=<<___;
adox %rax, %r13
adcx %rcx, %r14
- mulx 40($inp), $out, %r9
+ .byte 0xc4,0x62,0xc3,0xf6,0x8e,0x28,0x00,0x00,0x00 # mulx 40($inp), $out, %r9
adox $out, %r14
adcx %r9, %r15
@@ -594,27 +601,28 @@ $code.=<<___;
adox %rax, %r15
adcx %rcx, %r8
- .byte 0xc4,0x62,0xc3,0xf6,0x8e,0x38,0x00,0x00,0x00 # mulx 56($inp), $out, %r9
+ mulx 56($inp), $out, %r9
adox $out, %r8
adcx %rbp, %r9
+ mulx %rdx, %rax, $out
adox %rbp, %r9
+ mov 24($inp), %rdx
- mov %r13, %rcx
- shld \$1, %r12, %r13
- shld \$1, %rbx, %r12
-
- xor %ebp, %ebp
- mulx %rdx, %rax, %rdx
+ xor %rcx, %rcx
+ adox %r11, %r11
+ # rbx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rbx, %rax
+ adox %r12, %r12
adcx %rax, %r11
- adcx %rdx, %r12
- mov 24($inp), %rdx
- adcx %rbp, %r13
+ adox %rbp, %rcx
+ adcx $out, %r12
+ adcx %rbp, %rcx
mov %r11, 32(%rsp)
- .byte 0x4c,0x89,0xa4,0x24,0x28,0x00,0x00,0x00 # mov %r12, 40(%rsp)
+ mov %r12, 40(%rsp)
#fourth iteration
- .byte 0xc4,0xe2,0xfb,0xf6,0x9e,0x20,0x00,0x00,0x00 # mulx 32($inp), %rax, %rbx
+ mulx 32($inp), %rax, %rbx
adox %rax, %r14
adcx %rbx, %r15
@@ -629,25 +637,25 @@ $code.=<<___;
mulx 56($inp), $out, %r10
adox $out, %r9
adcx %rbp, %r10
+ mulx %rdx, %rax, $out
adox %rbp, %r10
+ mov 32($inp), %rdx
- .byte 0x66
- mov %r15, %rbx
- shld \$1, %r14, %r15
- shld \$1, %rcx, %r14
-
- xor %ebp, %ebp
- mulx %rdx, %rax, %rdx
+ xor %rbx, %rbx
+ adox %r13, %r13
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rcx, %rax
+ adox %r14, %r14
adcx %rax, %r13
- adcx %rdx, %r14
- mov 32($inp), %rdx
- adcx %rbp, %r15
+ adox %rbp, %rbx
+ adcx $out, %r14
+ adcx %rbp, %rbx
mov %r13, 48(%rsp)
mov %r14, 56(%rsp)
#fifth iteration
- .byte 0xc4,0x62,0xc3,0xf6,0x9e,0x28,0x00,0x00,0x00 # mulx 40($inp), $out, %r11
+ mulx 40($inp), $out, %r11
adox $out, %r8
adcx %r11, %r9
@@ -658,18 +666,19 @@ $code.=<<___;
mulx 56($inp), $out, %r11
adox $out, %r10
adcx %rbp, %r11
+ mulx %rdx, %rax, $out
+ mov 40($inp), %rdx
adox %rbp, %r11
- mov %r9, %rcx
- shld \$1, %r8, %r9
- shld \$1, %rbx, %r8
-
- xor %ebp, %ebp
- mulx %rdx, %rax, %rdx
+ xor %rcx, %rcx
+ adox %r15, %r15
+ # rbx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rbx, %rax
+ adox %r8, %r8
adcx %rax, %r15
- adcx %rdx, %r8
- mov 40($inp), %rdx
- adcx %rbp, %r9
+ adox %rbp, %rcx
+ adcx $out, %r8
+ adcx %rbp, %rcx
mov %r15, 64(%rsp)
mov %r8, 72(%rsp)
@@ -682,18 +691,19 @@ $code.=<<___;
.byte 0xc4,0x62,0xc3,0xf6,0xa6,0x38,0x00,0x00,0x00 # mulx 56($inp), $out, %r12
adox $out, %r11
adcx %rbp, %r12
+ mulx %rdx, %rax, $out
adox %rbp, %r12
+ mov 48($inp), %rdx
- mov %r11, %rbx
- shld \$1, %r10, %r11
- shld \$1, %rcx, %r10
-
- xor %ebp, %ebp
- mulx %rdx, %rax, %rdx
+ xor %rbx, %rbx
+ adox %r9, %r9
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rcx, %rax
+ adox %r10, %r10
adcx %rax, %r9
- adcx %rdx, %r10
- mov 48($inp), %rdx
- adcx %rbp, %r11
+ adcx $out, %r10
+ adox %rbp, %rbx
+ adcx %rbp, %rbx
mov %r9, 80(%rsp)
mov %r10, 88(%rsp)
@@ -703,31 +713,31 @@ $code.=<<___;
adox %rax, %r12
adox %rbp, %r13
- xor %r14, %r14
- shld \$1, %r13, %r14
- shld \$1, %r12, %r13
- shld \$1, %rbx, %r12
-
- xor %ebp, %ebp
- mulx %rdx, %rax, %rdx
- adcx %rax, %r11
- adcx %rdx, %r12
+ mulx %rdx, %rax, $out
+ xor %rcx, %rcx
mov 56($inp), %rdx
- adcx %rbp, %r13
+ adox %r11, %r11
+ # rbx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rbx, %rax
+ adox %r12, %r12
+ adcx %rax, %r11
+ adox %rbp, %rcx
+ adcx $out, %r12
+ adcx %rbp, %rcx
.byte 0x4c,0x89,0x9c,0x24,0x60,0x00,0x00,0x00 # mov %r11, 96(%rsp)
.byte 0x4c,0x89,0xa4,0x24,0x68,0x00,0x00,0x00 # mov %r12, 104(%rsp)
#eighth iteration
mulx %rdx, %rax, %rdx
- adox %rax, %r13
- adox %rbp, %rdx
+ xor %rbx, %rbx
+ adox %r13, %r13
+ # rcx <= 2 and rax <= 0xFFFF..F9, so carry must be zero here
+ adcx %rcx, %rax
+ adox %rbp, %rbx
+ adcx %r13, %rax
+ adcx %rdx, %rbx
- .byte 0x66
- add %rdx, %r14
-
- movq %r13, 112(%rsp)
- movq %r14, 120(%rsp)
movq %xmm0, $out
movq %xmm1, %rbp
@@ -741,6 +751,9 @@ $code.=<<___;
movq 48(%rsp), %r14
movq 56(%rsp), %r15
+ movq %rax, 112(%rsp)
+ movq %rbx, 120(%rsp)
+
call __rsaz_512_reducex
addq 64(%rsp), %r8
Index: openssl-1.1.1d/test/bntest.c
===================================================================
--- openssl-1.1.1d.orig/test/bntest.c
+++ openssl-1.1.1d/test/bntest.c
@@ -2352,6 +2352,288 @@ static int test_ctx_consttime_flag(void)
return st;
}
+typedef struct mod_exp_test_st
+{
+ const char *base;
+ const char *exp;
+ const char *mod;
+ const char *res;
+} MOD_EXP_TEST;
+
+static const MOD_EXP_TEST ModExpTests[] = {
+ /* original test vectors for rsaz_512_sqr bug, by OSS-Fuzz */
+ {
+ "1166180238001879113042182292626169621106255558914000595999312084"
+ "4627946820899490684928760491249738643524880720584249698100907201"
+ "002086675047927600340800371",
+ "8000000000000000000000000000000000000000000000000000000000000000"
+ "0000000000000000000000000000000000000000000000000000000000000000"
+ "00000000",
+ "1340780792684523720980737645613191762604395855615117867483316354"
+ "3294276330515137663421134775482798690129946803802212663956180562"
+ "088664022929883876655300863",
+ "8243904058268085430037326628480645845409758077568738532059032482"
+ "8294114415890603594730158120426756266457928475330450251339773498"
+ "26758407619521544102068438"
+ },
+ {
+ "4974270041410803822078866696159586946995877618987010219312844726"
+ "0284386121835740784990869050050504348861513337232530490826340663"
+ "197278031692737429054",
+ "4974270041410803822078866696159586946995877428188754995041148539"
+ "1663243362592271353668158565195557417149981094324650322556843202"
+ "946445882670777892608",
+ "1340780716511420227215592830971452482815377482627251725537099028"
+ "4429769497230131760206012644403029349547320953206103351725462999"
+ "947509743623340557059752191",
+ "5296244594780707015616522701706118082963369547253192207884519362"
+ "1767869984947542695665420219028522815539559194793619684334900442"
+ "49304558011362360473525933"
+ },
+ /* test vectors for rsaz_512_srq bug, with rcx/rbx=1 */
+ { /* between first and second iteration */
+ "5148719036160389201525610950887605325980251964889646556085286545"
+ "3931548809178823413169359635978762036512397113080988070677858033"
+ "36463909753993540214027190",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between second and third iteration */
+ "8908340854353752577419678771330460827942371434853054158622636544"
+ "8151360109722890949471912566649465436296659601091730745087014189"
+ "2672764191218875181826063",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between third and fourth iteration */
+ "3427446396505596330634350984901719674479522569002785244080234738"
+ "4288743635435746136297299366444548736533053717416735379073185344"
+ "26985272974404612945608761",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between fourth and fifth iteration */
+ "3472743044917564564078857826111874560045331237315597383869652985"
+ "6919870028890895988478351133601517365908445058405433832718206902"
+ "4088133164805266956353542",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between fifth and sixth iteration */
+ "3608632990153469264412378349742339216742409743898601587274768025"
+ "0110772032985643555192767717344946174122842255204082586753499651"
+ "14483434992887431333675068",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between sixth and seventh iteration */
+ "8455374370234070242910508226941981520235709767260723212165264877"
+ "8689064388017521524568434328264431772644802567028663962962025746"
+ "9283458217850119569539086",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between seventh and eighth iteration */
+ "5155371529688532178421209781159131443543419764974688878527112131"
+ "7446518205609427412336183157918981038066636807317733319323257603"
+ "04416292040754017461076359",
+ "1005585594745694782468051874865438459560952436544429503329267108"
+ "2791323022555160232601405723625177570767523893639864538140315412"
+ "108959927459825236754563832",
+ "1005585594745694782468051874865438459560952436544429503329267108"
+ "2791323022555160232601405723625177570767523893639864538140315412"
+ "108959927459825236754563833",
+ "1"
+ },
+ /* test vectors for rsaz_512_srq bug, with rcx/rbx=2 */
+ { /* between first and second iteration */
+ "3155666506033786929967309937640790361084670559125912405342594979"
+ "4345142818528956285490897841406338022378565972533508820577760065"
+ "58494345853302083699912572",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between second and third iteration */
+ "3789819583801342198190405714582958759005991915505282362397087750"
+ "4213544724644823098843135685133927198668818185338794377239590049"
+ "41019388529192775771488319",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between third and forth iteration */
+ "4695752552040706867080542538786056470322165281761525158189220280"
+ "4025547447667484759200742764246905647644662050122968912279199065"
+ "48065034299166336940507214",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between forth and fifth iteration */
+ "2159140240970485794188159431017382878636879856244045329971239574"
+ "8919691133560661162828034323196457386059819832804593989740268964"
+ "74502911811812651475927076",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between fifth and sixth iteration */
+ "5239312332984325668414624633307915097111691815000872662334695514"
+ "5436533521392362443557163429336808208137221322444780490437871903"
+ "99972784701334569424519255",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between sixth and seventh iteration */
+ "1977953647322612860406858017869125467496941904523063466791308891"
+ "1172796739058531929470539758361774569875505293428856181093904091"
+ "33788264851714311303725089",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042158",
+ "6703903964971298549787012499102923063739682910296196688861780721"
+ "8608820150367734884009371490834517138450159290932430254268769414"
+ "05973284973216824503042159",
+ "1"
+ },
+ { /* between seventh and eighth iteration */
+ "6456987954117763835533395796948878140715006860263624787492985786"
+ "8514630216966738305923915688821526449499763719943997120302368211"
+ "04813318117996225041943964",
+ "1340780792994259709957402499820584612747936582059239337772356144"
+ "3721764030073546976801874298166903427690031858186486050853753882"
+ "811946551499689575296532556",
+ "1340780792994259709957402499820584612747936582059239337772356144"
+ "3721764030073546976801874298166903427690031858186486050853753882"
+ "811946551499689575296532557",
+ "1"
+ }
+};
+
+static int test_mod_exp(int i)
+{
+ const MOD_EXP_TEST *test = &ModExpTests[i];
+ int res = 0;
+ BIGNUM* result = NULL;
+ BIGNUM *base = NULL, *exponent = NULL, *modulo = NULL;
+ char *s = NULL;
+
+ if (!TEST_ptr(result = BN_new())
+ || !TEST_true(BN_dec2bn(&base, test->base))
+ || !TEST_true(BN_dec2bn(&exponent, test->exp))
+ || !TEST_true(BN_dec2bn(&modulo, test->mod)))
+ goto err;
+
+ if (!TEST_int_eq(BN_mod_exp(result, base, exponent, modulo, ctx), 1))
+ goto err;
+
+ if (!TEST_ptr(s = BN_bn2dec(result)))
+ goto err;
+
+ if (!TEST_mem_eq(s, strlen(s), test->res, strlen(test->res)))
+ goto err;
+
+ res = 1;
+
+ err:
+ OPENSSL_free(s);
+ BN_free(result);
+ BN_free(base);
+ BN_free(exponent);
+ BN_free(modulo);
+ return res;
+}
+
+static int test_mod_exp_consttime(int i)
+{
+ const MOD_EXP_TEST *test = &ModExpTests[i];
+ int res = 0;
+ BIGNUM* result = NULL;
+ BIGNUM *base = NULL, *exponent = NULL, *modulo = NULL;
+ char *s = NULL;
+
+ if (!TEST_ptr(result = BN_new())
+ || !TEST_true(BN_dec2bn(&base, test->base))
+ || !TEST_true(BN_dec2bn(&exponent, test->exp))
+ || !TEST_true(BN_dec2bn(&modulo, test->mod)))
+ goto err;
+
+ BN_set_flags(base, BN_FLG_CONSTTIME);
+ BN_set_flags(exponent, BN_FLG_CONSTTIME);
+ BN_set_flags(modulo, BN_FLG_CONSTTIME);
+
+ if (!TEST_int_eq(BN_mod_exp(result, base, exponent, modulo, ctx), 1))
+ goto err;
+
+ if (!TEST_ptr(s = BN_bn2dec(result)))
+ goto err;
+
+ if (!TEST_mem_eq(s, strlen(s), test->res, strlen(test->res)))
+ goto err;
+
+ res = 1;
+
+ err:
+ OPENSSL_free(s);
+ BN_free(result);
+ BN_free(base);
+ BN_free(exponent);
+ BN_free(modulo);
+ return res;
+}
+
static int file_test_run(STANZA *s)
{
static const FILETEST filetests[] = {
@@ -2454,6 +2736,8 @@ int setup_tests(void)
#endif
ADD_ALL_TESTS(test_is_prime, (int)OSSL_NELEM(primes));
ADD_ALL_TESTS(test_not_prime, (int)OSSL_NELEM(not_primes));
+ ADD_ALL_TESTS(test_mod_exp, (int)OSSL_NELEM(ModExpTests));
+ ADD_ALL_TESTS(test_mod_exp_consttime, (int)OSSL_NELEM(ModExpTests));
} else {
ADD_ALL_TESTS(run_file_tests, n);
}
Reference in New Issue View Git Blame Copy Permalink