Update from 0.9.8-stable with patches also applied to equivalent FIPS (8c3b5d5f) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+37 −0

Original line number	Diff line number	Diff line
		@@ -61,6 +61,43 @@

		Changes between 0.9.8e and 0.9.8f [23 Feb 2007]

		*) Mitigate branch prediction attacks, which can be practical if a
		single processor is shared, allowing a spy process to extract
		information. For detailed background information, see
		http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
		J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
		and Necessary Software Countermeasures"). The core of the change
		are new versions BN_div_no_branch() and
		BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
		respectively, which are slower, but avoid the security-relevant
		conditional branches. These are automatically called by BN_div()
		and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for the
		modulus. Also, BN_is_bit_set() has been changed to remove a
		conditional branch.

		BN_FLG_CONSTTIME is the new name for the previous
		BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
		modular exponentiation. (Since OpenSSL 0.9.7h, setting this flag
		in the exponent causes BN_mod_exp_mont() to use the alternative
		implementation in BN_mod_exp_mont_consttime().) The old name
		remains as a deprecated alias.

		Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
		RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
		constant-time implementations for more than just exponentiation.
		Here too the old name is kept as a deprecated alias.

		BN_BLINDING_new() will now use BN_dup() for the modulus so that
		the BN_BLINDING structure gets an independent copy of the
		modulus. This means that the previous "BIGNUM *m" argument to
		BN_BLINDING_new() and to BN_BLINDING_create_param() now
		essentially becomes "const BIGNUM *m", although we can't actually
		change this in the header file before 0.9.9. It allows
		RSA_setup_blinding() to use BN_with_flags() on the modulus to
		enable BN_FLG_CONSTTIME.

		[Matthew D Wood (Intel Corp)]

		*) In the SSL/TLS server implementation, be strict about session ID
		context matching (which matters if an application uses a single
		external cache for different purposes). Previously,

crypto/bn/bn.h

+18 −4

Original line number	Diff line number	Diff line
		@@ -245,8 +245,18 @@ extern "C" {

		#define BN_FLG_MALLOCED 0x01
		#define BN_FLG_STATIC_DATA 0x02
		#define BN_FLG_EXP_CONSTTIME 0x04 /* avoid leaking exponent information through timings
		#define BN_FLG_CONSTTIME 0x04 /* avoid leaking exponent information through timing,
		* BN_mod_exp_mont() will call BN_mod_exp_mont_consttime,
		* BN_div() will call BN_div_no_branch,
		* BN_mod_inverse() will call BN_mod_inverse_no_branch.
		*/

		#ifndef OPENSSL_NO_DEPRECATED
		#define BN_FLG_EXP_CONSTTIME BN_FLG_CONSTTIME /* deprecated name for the flag */
		/* avoid leaking exponent information through timings
		* (BN_mod_exp_mont() will call BN_mod_exp_mont_consttime) */
		#endif

		#ifndef OPENSSL_NO_DEPRECATED
		#define BN_FLG_FREE 0x8000 /* used for debuging */
		#endif
		@@ -425,6 +435,8 @@ void BN_set_negative(BIGNUM *b, int n);

		int BN_div(BIGNUM dv, BIGNUM rem, const BIGNUM m, const BIGNUM d,
		BN_CTX *ctx);
		int BN_div_no_branch(BIGNUM dv, BIGNUM rem, const BIGNUM *m,
		const BIGNUM d, BN_CTX ctx);
		#define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))
		int BN_nnmod(BIGNUM r, const BIGNUM m, const BIGNUM d, BN_CTX ctx);
		int BN_mod_add(BIGNUM r, const BIGNUM a, const BIGNUM b, const BIGNUM m, BN_CTX *ctx);
		@@ -493,6 +505,8 @@ int BN_gcd(BIGNUM r,const BIGNUM a,const BIGNUM b,BN_CTX ctx);
		int BN_kronecker(const BIGNUM a,const BIGNUM b,BN_CTX ctx); / returns -2 for error */
		BIGNUM BN_mod_inverse(BIGNUM ret,
		const BIGNUM a, const BIGNUM n,BN_CTX *ctx);
		BIGNUM BN_mod_inverse_no_branch(BIGNUM ret,
		const BIGNUM A, const BIGNUM n,BN_CTX *ctx);
		BIGNUM BN_mod_sqrt(BIGNUM ret,
		const BIGNUM a, const BIGNUM n,BN_CTX *ctx);

		@@ -554,7 +568,7 @@ BN_MONT_CTX BN_MONT_CTX_set_locked(BN_MONT_CTX *pmont, int lock,
		#define BN_BLINDING_NO_UPDATE 0x00000001
		#define BN_BLINDING_NO_RECREATE 0x00000002

		BN_BLINDING BN_BLINDING_new(const BIGNUM A, const BIGNUM Ai, BIGNUM mod);
		BN_BLINDING BN_BLINDING_new(const BIGNUM A, const BIGNUM Ai, / const / BIGNUM mod);
		void BN_BLINDING_free(BN_BLINDING *b);
		int BN_BLINDING_update(BN_BLINDING b,BN_CTX ctx);
		int BN_BLINDING_convert(BIGNUM n, BN_BLINDING b, BN_CTX *ctx);
		@@ -566,7 +580,7 @@ void BN_BLINDING_set_thread_id(BN_BLINDING *, unsigned long);
		unsigned long BN_BLINDING_get_flags(const BN_BLINDING *);
		void BN_BLINDING_set_flags(BN_BLINDING *, unsigned long);
		BN_BLINDING BN_BLINDING_create_param(BN_BLINDING b,
		const BIGNUM e, BIGNUM m, BN_CTX *ctx,
		const BIGNUM e, / const / BIGNUM m, BN_CTX *ctx,
		int (bn_mod_exp)(BIGNUM r, const BIGNUM a, const BIGNUM p,
		const BIGNUM m, BN_CTX ctx, BN_MONT_CTX *m_ctx),
		BN_MONT_CTX *m_ctx);

crypto/bn/bn_blind.c

+9 −3

Original line number	Diff line number	Diff line
		@@ -131,7 +131,7 @@ struct bn_blinding_st
		BN_MONT_CTX *m_ctx);
		};

		BN_BLINDING BN_BLINDING_new(const BIGNUM A, const BIGNUM Ai, BIGNUM mod)
		BN_BLINDING BN_BLINDING_new(const BIGNUM A, const BIGNUM Ai, / const / BIGNUM mod)
		{
		BN_BLINDING *ret=NULL;

		@@ -151,7 +151,12 @@ BN_BLINDING BN_BLINDING_new(const BIGNUM A, const BIGNUM Ai, BIGNUM mod)
		{
		if ((ret->Ai = BN_dup(Ai)) == NULL) goto err;
		}
		ret->mod = mod;

		/* save a copy of mod in the BN_BLINDING structure */
		if ((ret->mod = BN_dup(mod)) == NULL) goto err;
		if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
		BN_set_flags(ret->mod, BN_FLG_CONSTTIME);

		ret->counter = BN_BLINDING_COUNTER;
		return(ret);
		err:
		@@ -167,6 +172,7 @@ void BN_BLINDING_free(BN_BLINDING *r)
		if (r->A != NULL) BN_free(r->A );
		if (r->Ai != NULL) BN_free(r->Ai);
		if (r->e != NULL) BN_free(r->e );
		if (r->mod != NULL) BN_free(r->mod);
		OPENSSL_free(r);
		}

		@@ -278,7 +284,7 @@ void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags)
		}

		BN_BLINDING BN_BLINDING_create_param(BN_BLINDING b,
		const BIGNUM e, BIGNUM m, BN_CTX *ctx,
		const BIGNUM e, / const / BIGNUM m, BN_CTX *ctx,
		int (bn_mod_exp)(BIGNUM r, const BIGNUM a, const BIGNUM p,
		const BIGNUM m, BN_CTX ctx, BN_MONT_CTX *m_ctx),
		BN_MONT_CTX *m_ctx)

crypto/bn/bn_div.c

+229 −0

Original line number	Diff line number	Diff line
		@@ -185,6 +185,11 @@ int BN_div(BIGNUM dv, BIGNUM rm, const BIGNUM num, const BIGNUM divisor,
		BN_ULONG d0,d1;
		int num_n,div_n;

		if (BN_get_flags(num, BN_FLG_CONSTTIME) != 0)
		{
		return BN_div_no_branch(dv, rm, num, divisor, ctx);
		}

		bn_check_top(dv);
		bn_check_top(rm);
		bn_check_top(num);
		@@ -330,6 +335,230 @@ X) -> 0x%08X\n",
		rem=(n1-q*d0)&BN_MASK2;
		#endif

		#if defined(BN_UMULT_LOHI)
		BN_UMULT_LOHI(t2l,t2h,d1,q);
		#elif defined(BN_UMULT_HIGH)
		t2l = d1 * q;
		t2h = BN_UMULT_HIGH(d1,q);
		#else
		t2l=LBITS(d1); t2h=HBITS(d1);
		ql =LBITS(q); qh =HBITS(q);
		mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1q; /
		#endif

		for (;;)
		{
		if ((t2h < rem) \|\|
		((t2h == rem) && (t2l <= wnump[-2])))
		break;
		q--;
		rem += d0;
		if (rem < d0) break; /* don't let rem overflow */
		if (t2l < d1) t2h--; t2l -= d1;
		}
		#endif /* !BN_LLONG */
		}
		#endif /* !BN_DIV3W */

		l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
		tmp->d[div_n]=l0;
		wnum.d--;
		/* ingore top values of the bignums just sub the two
		* BN_ULONG arrays with bn_sub_words */
		if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n+1))
		{
		/* Note: As we have considered only the leading
		* two BN_ULONGs in the calculation of q, sdiv * q
		* might be greater than wnum (but then (q-1) * sdiv
		* is less or equal than wnum)
		*/
		q--;
		if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n))
		/* we can't have an overflow here (assuming
		* that q != 0, but if q == 0 then tmp is
		* zero anyway) */
		(*wnump)++;
		}
		/* store part of the result */
		*resp = q;
		}
		bn_correct_top(snum);
		if (rm != NULL)
		{
		/* Keep a copy of the neg flag in num because if rm==num
		* BN_rshift() will overwrite it.
		*/
		int neg = num->neg;
		BN_rshift(rm,snum,norm_shift);
		if (!BN_is_zero(rm))
		rm->neg = neg;
		bn_check_top(rm);
		}
		BN_CTX_end(ctx);
		return(1);
		err:
		bn_check_top(rm);
		BN_CTX_end(ctx);
		return(0);
		}


		/* BN_div_no_branch is a special version of BN_div. It does not contain
		* branches that may leak sensitive information.
		*/
		int BN_div_no_branch(BIGNUM dv, BIGNUM rm, const BIGNUM *num,
		const BIGNUM divisor, BN_CTX ctx)
		{
		int norm_shift,i,loop;
		BIGNUM tmp,wnum,snum,sdiv,res;
		BN_ULONG resp,wnump;
		BN_ULONG d0,d1;
		int num_n,div_n;

		bn_check_top(dv);
		bn_check_top(rm);
		bn_check_top(num);
		bn_check_top(divisor);

		if (BN_is_zero(divisor))
		{
		BNerr(BN_F_BN_DIV,BN_R_DIV_BY_ZERO);
		return(0);
		}

		BN_CTX_start(ctx);
		tmp=BN_CTX_get(ctx);
		snum=BN_CTX_get(ctx);
		sdiv=BN_CTX_get(ctx);
		if (dv == NULL)
		res=BN_CTX_get(ctx);
		else res=dv;
		if (sdiv == NULL \|\| res == NULL) goto err;

		/* First we normalise the numbers */
		norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
		if (!(BN_lshift(sdiv,divisor,norm_shift))) goto err;
		sdiv->neg=0;
		norm_shift+=BN_BITS2;
		if (!(BN_lshift(snum,num,norm_shift))) goto err;
		snum->neg=0;

		/* Since we don't know whether snum is larger than sdiv,
		* we pad snum with enough zeroes without changing its
		* value.
		*/
		if (snum->top <= sdiv->top+1)
		{
		if (bn_wexpand(snum, sdiv->top + 2) == NULL) goto err;
		for (i = snum->top; i < sdiv->top + 2; i++) snum->d[i] = 0;
		snum->top = sdiv->top + 2;
		}
		else
		{
		if (bn_wexpand(snum, snum->top + 1) == NULL) goto err;
		snum->d[snum->top] = 0;
		snum->top ++;
		}

		div_n=sdiv->top;
		num_n=snum->top;
		loop=num_n-div_n;
		/* Lets setup a 'window' into snum
		* This is the part that corresponds to the current
		* 'area' being divided */
		wnum.neg = 0;
		wnum.d = &(snum->d[loop]);
		wnum.top = div_n;
		/* only needed when BN_ucmp messes up the values between top and max */
		wnum.dmax = snum->dmax - loop; /* so we don't step out of bounds */

		/* Get the top 2 words of sdiv */
		/* div_n=sdiv->top; */
		d0=sdiv->d[div_n-1];
		d1=(div_n == 1)?0:sdiv->d[div_n-2];

		/* pointer to the 'top' of snum */
		wnump= &(snum->d[num_n-1]);

		/* Setup to 'res' */
		res->neg= (num->neg^divisor->neg);
		if (!bn_wexpand(res,(loop+1))) goto err;
		res->top=loop-1;
		resp= &(res->d[loop-1]);

		/* space for temp */
		if (!bn_wexpand(tmp,(div_n+1))) goto err;

		/* if res->top == 0 then clear the neg value otherwise decrease
		* the resp pointer */
		if (res->top == 0)
		res->neg = 0;
		else
		resp--;

		for (i=0; i<loop-1; i++, wnump--, resp--)
		{
		BN_ULONG q,l0;
		/* the first part of the loop uses the top two words of
		* snum and sdiv to calculate a BN_ULONG q such that
		* \| wnum - sdiv * q \| < sdiv */
		#if defined(BN_DIV3W) && !defined(OPENSSL_NO_ASM)
		BN_ULONG bn_div_3_words(BN_ULONG*,BN_ULONG,BN_ULONG);
		q=bn_div_3_words(wnump,d1,d0);
		#else
		BN_ULONG n0,n1,rem=0;

		n0=wnump[0];
		n1=wnump[-1];
		if (n0 == d0)
		q=BN_MASK2;
		else /* n0 < d0 */
		{
		#ifdef BN_LLONG
		BN_ULLONG t2;

		#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
		q=(BN_ULONG)(((((BN_ULLONG)n0)<<BN_BITS2)\|n1)/d0);
		#else
		q=bn_div_words(n0,n1,d0);
		#ifdef BN_DEBUG_LEVITTE
		fprintf(stderr,"DEBUG: bn_div_words(0x%08X,0x%08X,0x%08\
		X) -> 0x%08X\n",
		n0, n1, d0, q);
		#endif
		#endif

		#ifndef REMAINDER_IS_ALREADY_CALCULATED
		/*
		* rem doesn't have to be BN_ULLONG. The least we
		* know it's less that d0, isn't it?
		*/
		rem=(n1-q*d0)&BN_MASK2;
		#endif
		t2=(BN_ULLONG)d1*q;

		for (;;)
		{
		if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)\|wnump[-2]))
		break;
		q--;
		rem += d0;
		if (rem < d0) break; /* don't let rem overflow */
		t2 -= d1;
		}
		#else /* !BN_LLONG */
		BN_ULONG t2l,t2h,ql,qh;

		q=bn_div_words(n0,n1,d0);
		#ifdef BN_DEBUG_LEVITTE
		fprintf(stderr,"DEBUG: bn_div_words(0x%08X,0x%08X,0x%08\
		X) -> 0x%08X\n",
		n0, n1, d0, q);
		#endif
		#ifndef REMAINDER_IS_ALREADY_CALCULATED
		rem=(n1-q*d0)&BN_MASK2;
		#endif

		#if defined(BN_UMULT_LOHI)
		BN_UMULT_LOHI(t2l,t2h,d1,q);
		#elif defined(BN_UMULT_HIGH)

crypto/bn/bn_exp.c

+10 −10

Original line number	Diff line number	Diff line
		@@ -122,9 +122,9 @@ int BN_exp(BIGNUM r, const BIGNUM a, const BIGNUM p, BN_CTX ctx)
		int i,bits,ret=0;
		BIGNUM v,rr;

		if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
		if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
		{
		/* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
		/* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
		BNerr(BN_F_BN_EXP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
		return -1;
		}
		@@ -213,7 +213,7 @@ int BN_mod_exp(BIGNUM r, const BIGNUM a, const BIGNUM p, const BIGNUM m,
		if (BN_is_odd(m))
		{
		# ifdef MONT_EXP_WORD
		if (a->top == 1 && !a->neg && (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) == 0))
		if (a->top == 1 && !a->neg && (BN_get_flags(p, BN_FLG_CONSTTIME) == 0))
		{
		BN_ULONG A = a->d[0];
		ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
		@@ -245,9 +245,9 @@ int BN_mod_exp_recp(BIGNUM r, const BIGNUM a, const BIGNUM *p,
		BIGNUM *val[TABLE_SIZE];
		BN_RECP_CTX recp;

		if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
		if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
		{
		/* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
		/* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
		BNerr(BN_F_BN_MOD_EXP_RECP,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
		return -1;
		}
		@@ -379,7 +379,7 @@ int BN_mod_exp_mont(BIGNUM rr, const BIGNUM a, const BIGNUM *p,
		BIGNUM *val[TABLE_SIZE];
		BN_MONT_CTX *mont=NULL;

		if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
		if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
		{
		return BN_mod_exp_mont_consttime(rr, a, p, m, ctx, in_mont);
		}
		@@ -745,9 +745,9 @@ int BN_mod_exp_mont_word(BIGNUM rr, BN_ULONG a, const BIGNUM p,
		#define BN_TO_MONTGOMERY_WORD(r, w, mont) \
		(BN_set_word(r, (w)) && BN_to_montgomery(r, r, (mont), ctx))

		if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
		if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
		{
		/* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
		/* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
		BNerr(BN_F_BN_MOD_EXP_MONT_WORD,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
		return -1;
		}
		@@ -881,9 +881,9 @@ int BN_mod_exp_simple(BIGNUM r, const BIGNUM a, const BIGNUM *p,
		/* Table of variables obtained from 'ctx' */
		BIGNUM *val[TABLE_SIZE];

		if (BN_get_flags(p, BN_FLG_EXP_CONSTTIME) != 0)
		if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0)
		{
		/* BN_FLG_EXP_CONSTTIME only supported by BN_mod_exp_mont() */
		/* BN_FLG_CONSTTIME only supported by BN_mod_exp_mont() */
		BNerr(BN_F_BN_MOD_EXP_SIMPLE,ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
		return -1;
		}

Admin message