Commit 9e1403d9 authored by Bernd Edlinger's avatar Bernd Edlinger
Browse files

Fix a SCA leak in BN_generate_dsa_nonce 



Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
Reviewed-by: default avatarNicola Tuveri <nic.tuv@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/9782)

(cherry picked from commit 31ca19403d56ad71d823cf62990518dfc6905bb4)
parent 1bb2acb9

crypto/bn/bn_rand.c

+1 −4
Original line number Diff line number Diff line
@@ -225,8 +225,7 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range, 
        goto err;



    /* We copy |priv| into a local buffer to avoid exposing its length. */

    todo = sizeof(priv->d[0]) * priv->top;

    if (todo > sizeof(private_bytes)) {

    if (BN_bn2binpad(priv, private_bytes, sizeof(private_bytes)) < 0) {

        /*

         * No reasonable DSA or ECDSA key should have a private key this

         * large and we don't handle this case in order to avoid leaking the
@@ -235,8 +234,6 @@ int BN_generate_dsa_nonce(BIGNUM *out, const BIGNUM *range, 
        BNerr(BN_F_BN_GENERATE_DSA_NONCE, BN_R_PRIVATE_KEY_TOO_LARGE);

        goto err;

    }

    memcpy(private_bytes, priv->d, todo);

    memset(private_bytes + todo, 0, sizeof(private_bytes) - todo);



    for (done = 0; done < num_k_bytes;) {

        if (RAND_priv_bytes(random_bytes, sizeof(random_bytes)) != 1)