forked from pool/libgcrypt
Pedro Monreal Gonzalez
211bd2f53b
- Update to 1.8.6
* mpi: Consider +0 and -0 the same in mpi_cmp
* mpi: Fix flags in mpi_copy for opaque MPI
* mpi: Fix the return value of mpi_invm_generic
* mpi: DSA,ECDSA: Fix use of mpi_invm
- Call mpi_invm before _gcry_dsa_modify_k
- Call mpi_invm before _gcry_ecc_ecdsa_sign
* mpi: Constant time mpi_inv with some conditions
- mpi/mpi-inv.c (mpih_add_n_cond, mpih_sub_n_cond, mpih_swap_cond)
- New: mpih_abs_cond, mpi_invm_odd
- Rename from _gcry_mpi_invm: mpi_invm_generic
- Use mpi_invm_odd for usual odd cases: _gcry_mpi_invm
* mpi: Abort on division by zero also in _gcry_mpi_tdiv_qr
* Fix wrong code execution in Poly1305 ARM/NEON implementation
- Set r14 to -1 at function entry: (_gcry_poly1305_armv7_neon_init_ext)
* Set vZZ.16b register to zero before use in armv8 gcm implementation
* random: Fix include of config.h
* Fix declaration of internal function _gcry_mpi_get_ui: Don't use ulong
* ecc: Fix wrong handling of shorten PK bytes
- Zeros are already recovered: (_gcry_ecc_mont_decodepoint)
- Update libgcrypt-ecc-ecdsa-no-blinding.patch
OBS-URL: https://build.opensuse.org/request/show/819163
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/libgcrypt?expand=0&rev=138
84 lines
3.0 KiB
Diff
84 lines
3.0 KiB
Diff
Index: libgcrypt-1.8.5/cipher/ecc.c
|
|
===================================================================
|
|
--- libgcrypt-1.8.5.orig/cipher/ecc.c
|
|
+++ libgcrypt-1.8.5/cipher/ecc.c
|
|
@@ -2060,11 +2060,11 @@ selftest_sign (gcry_sexp_t pkey, gcry_se
|
|
{
|
|
/* Sample data from RFC 6979 section A.2.5, hash is of message "sample" */
|
|
static const char sample_data[] =
|
|
- "(data (flags rfc6979)"
|
|
+ "(data (flags rfc6979 no-blinding)"
|
|
" (hash sha256 #af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e98915"
|
|
/**/ "62113d8a62add1bf#))";
|
|
static const char sample_data_bad[] =
|
|
- "(data (flags rfc6979)"
|
|
+ "(data (flags rfc6979 no-blinding)"
|
|
" (hash sha256 #bf2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e98915"
|
|
/**/ "62113d8a62add1bf#))";
|
|
static const char signature_r[] =
|
|
Index: libgcrypt-1.8.5/cipher/ecc-ecdsa.c
|
|
===================================================================
|
|
--- libgcrypt-1.8.5.orig/cipher/ecc-ecdsa.c
|
|
+++ libgcrypt-1.8.5/cipher/ecc-ecdsa.c
|
|
@@ -52,6 +52,7 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input,
|
|
mpi_ec_t ctx;
|
|
gcry_mpi_t b; /* Random number needed for blinding. */
|
|
gcry_mpi_t bi; /* multiplicative inverse of B. */
|
|
+ int with_blinding = !(flags & PUBKEY_FLAG_NO_BLINDING);
|
|
|
|
if (DBG_CIPHER)
|
|
log_mpidump ("ecdsa sign hash ", input );
|
|
@@ -65,12 +66,15 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input,
|
|
|
|
b = mpi_snew (qbits);
|
|
bi = mpi_snew (qbits);
|
|
- do
|
|
+ if (with_blinding)
|
|
{
|
|
- _gcry_mpi_randomize (b, qbits, GCRY_WEAK_RANDOM);
|
|
- mpi_mod (b, b, skey->E.n);
|
|
+ do
|
|
+ {
|
|
+ _gcry_mpi_randomize (b, qbits, GCRY_WEAK_RANDOM);
|
|
+ mpi_mod (b, b, skey->E.n);
|
|
+ }
|
|
+ while (!mpi_invm (bi, b, skey->E.n));
|
|
}
|
|
- while (!mpi_invm (bi, b, skey->E.n));
|
|
|
|
k = NULL;
|
|
dr = mpi_alloc (0);
|
|
@@ -128,14 +132,25 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input,
|
|
}
|
|
while (!mpi_cmp_ui (r, 0));
|
|
|
|
- /* Computation of dr, sum, and s are blinded with b. */
|
|
- mpi_mulm (dr, b, skey->d, skey->E.n);
|
|
- mpi_mulm (dr, dr, r, skey->E.n); /* dr = d*r mod n */
|
|
- mpi_mulm (sum, b, hash, skey->E.n);
|
|
- mpi_addm (sum, sum, dr, skey->E.n); /* sum = hash + (d*r) mod n */
|
|
+ if (!with_blinding)
|
|
+ {
|
|
+ mpi_mulm (dr, skey->d, r, skey->E.n); /* dr = d*r mod n */
|
|
+ mpi_addm (sum, hash, dr, skey->E.n); /* sum = hash + (d*r) mod n */
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+ /* Computation of dr, sum, and s are blinded with b. */
|
|
+ mpi_mulm (dr, b, skey->d, skey->E.n);
|
|
+ mpi_mulm (dr, dr, r, skey->E.n); /* dr = d*r mod n */
|
|
+ mpi_mulm (sum, b, hash, skey->E.n);
|
|
+ mpi_addm (sum, sum, dr, skey->E.n); /* sum = hash + (d*r) mod n */
|
|
+ }
|
|
mpi_mulm (s, k_1, sum, skey->E.n); /* s = k^(-1)*(hash+(d*r)) mod n */
|
|
- /* Undo blinding by b^-1 */
|
|
- mpi_mulm (s, bi, s, skey->E.n);
|
|
+ if (with_blinding)
|
|
+ {
|
|
+ /* Undo blinding by b^-1 */
|
|
+ mpi_mulm (s, bi, s, skey->E.n);
|
|
+ }
|
|
}
|
|
while (!mpi_cmp_ui (s, 0));
|
|
|