Deprecate the flags that switch off constant time (5584f65a) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+6 −0

Changes for CHANGES: 6 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -4,6 +4,12 @@

		Changes between 1.0.2h and 1.1.0 [xx XXX 2016]

		*) The flags RSA_FLAG_NO_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME and
		DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch
		off the constant time implementation for RSA, DSA and DH have been made
		no-ops and deprecated.
		[Matt Caswell]

		*) Windows RAND implementation was simplified to only get entropy by
		calling CryptGenRandom(). Various other RAND-related tickets
		were also closed.

+5 −22

Changes for crypto/dh/dh_key.c: 5 added lines, 22 removed lines.
Original line number	Diff line number	Diff line
		@@ -113,24 +113,18 @@ static int generate_key(DH *dh)
		}

		{
		BIGNUM *local_prk = NULL;
		BIGNUM *prk;
		BIGNUM *prk = BN_new();

		if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {
		local_prk = prk = BN_new();
		if (local_prk == NULL)
		if (prk == NULL)
		goto err;
		BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
		} else {
		prk = priv_key;
		}

		if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) {
		BN_free(local_prk);
		BN_free(prk);
		goto err;
		}
		/* We MUST free local_prk before any further use of priv_key */
		BN_free(local_prk);
		/* We MUST free prk before any further use of priv_key */
		BN_free(prk);
		}

		dh->pub_key = pub_key;
		@@ -175,10 +169,7 @@ static int compute_key(unsigned char key, const BIGNUM pub_key, DH *dh)
		if (dh->flags & DH_FLAG_CACHE_MONT_P) {
		mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
		dh->lock, dh->p, ctx);
		if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {
		/* XXX */
		BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME);
		}
		if (!mont)
		goto err;
		}
		@@ -207,14 +198,6 @@ static int dh_bn_mod_exp(const DH dh, BIGNUM r,
		const BIGNUM a, const BIGNUM p,
		const BIGNUM m, BN_CTX ctx, BN_MONT_CTX *m_ctx)
		{
		/*
		* If a is only one word long and constant time is false, use the faster
		* exponentiation function.
		*/
		if (bn_get_top(a) == 1 && ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) != 0)) {
		BN_ULONG A = bn_get_words(a)[0];
		return BN_mod_exp_mont_word(r, A, p, m, ctx, m_ctx);
		} else
		return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
		}

+5 −11

Changes for crypto/dsa/dsa_key.c: 5 added lines, 11 removed lines.
Original line number	Diff line number	Diff line
		@@ -50,24 +50,18 @@ static int dsa_builtin_keygen(DSA *dsa)
		pub_key = dsa->pub_key;

		{
		BIGNUM *local_prk = NULL;
		BIGNUM *prk;
		BIGNUM *prk = BN_new();

		if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
		local_prk = prk = BN_new();
		if (local_prk == NULL)
		if (prk == NULL)
		goto err;
		BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
		} else {
		prk = priv_key;
		}

		if (!BN_mod_exp(pub_key, dsa->g, prk, dsa->p, ctx)) {
		BN_free(local_prk);
		BN_free(prk);
		goto err;
		}
		/* We MUST free local_prk before any further use of priv_key */
		BN_free(local_prk);
		/* We MUST free prk before any further use of priv_key */
		BN_free(prk);
		}

		dsa->priv_key = priv_key;

+4 −12

Changes for crypto/dsa/dsa_ossl.c: 4 added lines, 12 removed lines.
Original line number	Diff line number	Diff line
		@@ -135,7 +135,7 @@ static int dsa_sign_setup(DSA dsa, BN_CTX ctx_in,
		const unsigned char *dgst, int dlen)
		{
		BN_CTX *ctx = NULL;
		BIGNUM k, kq, K, kinv = NULL, r = rp;
		BIGNUM k, kq, kinv = NULL, r = *rp;
		int ret = 0;

		if (!dsa->p \|\| !dsa->q \|\| !dsa->g) {
		@@ -176,7 +176,6 @@ static int dsa_sign_setup(DSA dsa, BN_CTX ctx_in,

		/* Compute r = (g^k mod p) mod q */

		if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
		if (!BN_copy(kq, k))
		goto err;

		@@ -194,21 +193,14 @@ static int dsa_sign_setup(DSA dsa, BN_CTX ctx_in,
		goto err;
		}

		K = kq;
		} else {
		K = k;
		}

		if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
		BN_set_flags(K, BN_FLG_CONSTTIME);
		}
		BN_set_flags(kq, BN_FLG_CONSTTIME);

		if ((dsa)->meth->bn_mod_exp != NULL) {
		if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, K, dsa->p, ctx,
		if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, kq, dsa->p, ctx,
		dsa->method_mont_p))
		goto err;
		} else {
		if (!BN_mod_exp_mont(r, dsa->g, K, dsa->p, ctx, dsa->method_mont_p))
		if (!BN_mod_exp_mont(r, dsa->g, kq, dsa->p, ctx, dsa->method_mont_p))
		goto err;
		}

+5 −10

Changes for crypto/rsa/rsa_crpt.c: 5 added lines, 10 removed lines.
Original line number	Diff line number	Diff line
		@@ -147,23 +147,18 @@ BN_BLINDING RSA_setup_blinding(RSA rsa, BN_CTX *in_ctx)
		}

		{
		BIGNUM local_n = NULL, n;
		if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
		/* Set BN_FLG_CONSTTIME flag */
		local_n = n = BN_new();
		if (local_n == NULL) {
		BIGNUM *n = BN_new();

		if (n == NULL) {
		RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_MALLOC_FAILURE);
		goto err;
		}
		BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);
		} else {
		n = rsa->n;
		}

		ret = BN_BLINDING_create_param(NULL, e, n, ctx, rsa->meth->bn_mod_exp,
		rsa->_method_mod_n);
		/* We MUST free local_n before any further use of rsa->n */
		BN_free(local_n);
		/* We MUST free n before any further use of rsa->n */
		BN_free(n);
		}
		if (ret == NULL) {
		RSAerr(RSA_F_RSA_SETUP_BLINDING, ERR_R_BN_LIB);