Commit b1d6d55e authored by Pauli's avatar Pauli
Browse files

Timing vulnerability in ECDSA signature generation (CVE-2018-0735) 



Preallocate an extra limb for some of the big numbers to avoid a reallocation
that can potentially provide a side channel.

Reviewed-by: default avatarBernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/7486)

(cherry picked from commit 99540ec79491f59ed8b46b4edf130e17dc907f52)
parent 8abfe72e

crypto/ec/ec_mult.c

+3 −3
Original line number Diff line number Diff line
@@ -206,8 +206,8 @@ int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r, 
     */

    cardinality_bits = BN_num_bits(cardinality);

    group_top = bn_get_top(cardinality);

    if ((bn_wexpand(k, group_top + 1) == NULL)

        || (bn_wexpand(lambda, group_top + 1) == NULL)) {

    if ((bn_wexpand(k, group_top + 2) == NULL)

        || (bn_wexpand(lambda, group_top + 2) == NULL)) {

        ECerr(EC_F_EC_SCALAR_MUL_LADDER, ERR_R_BN_LIB);

        goto err;

    }
@@ -244,7 +244,7 @@ int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r, 
     * k := scalar + 2*cardinality

     */

    kbit = BN_is_bit_set(lambda, cardinality_bits);

    BN_consttime_swap(kbit, k, lambda, group_top + 1);

    BN_consttime_swap(kbit, k, lambda, group_top + 2);



    group_top = bn_get_top(group->field);

    if ((bn_wexpand(s->X, group_top) == NULL)