Commit cb6fdc3a authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Update from stable branch.

parent 8c3b5d5f

CHANGES

+37 −0
Changes for CHANGES: 37 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -98,6 +98,43 @@ 


     [Matthew D Wood (Intel Corp)]



  *) Mitigate branch prediction attacks, which can be practical if a

     single processor is shared, allowing a spy process to extract

     information.  For detailed background information, see

     http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,

     J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL

     and Necessary Software Countermeasures").  The core of the change

     are new versions BN_div_no_branch() and

     BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),

     respectively, which are slower, but avoid the security-relevant

     conditional branches.  These are automatically called by BN_div()

     and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one

     of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to

     remove a conditional branch.



     BN_FLG_CONSTTIME is the new name for the previous

     BN_FLG_EXP_CONSTTIME flag, since it now affects more than just

     modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag

     in the exponent causes BN_mod_exp_mont() to use the alternative

     implementation in BN_mod_exp_mont_consttime().)  The old name

     remains as a deprecated alias.



     Similary, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general

     RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses

     constant-time implementations for more than just exponentiation.

     Here too the old name is kept as a deprecated alias.



     BN_BLINDING_new() will now use BN_dup() for the modulus so that

     the BN_BLINDING structure gets an independent copy of the

     modulus.  This means that the previous "BIGNUM *m" argument to

     BN_BLINDING_new() and to BN_BLINDING_create_param() now

     essentially becomes "const BIGNUM *m", although we can't actually

     change this in the header file before 0.9.9.  It allows

     RSA_setup_blinding() to use BN_with_flags() on the modulus to

     enable BN_FLG_CONSTTIME.



     [Matthew D Wood (Intel Corp)]



  *) In the SSL/TLS server implementation, be strict about session ID

     context matching (which matters if an application uses a single

     external cache for different purposes).  Previously,

crypto/bn/bn_div.c

+1 −1
Changes for crypto/bn/bn_div.c: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -185,7 +185,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, 
	BN_ULONG d0,d1;

	int num_n,div_n;



	if (BN_get_flags(num, BN_FLG_CONSTTIME) != 0)

	if ((BN_get_flags(num, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(divisor, BN_FLG_CONSTTIME) != 0))

		{

		return BN_div_no_branch(dv, rm, num, divisor, ctx);

		}

crypto/bn/bn_gcd.c

+1 −1
Changes for crypto/bn/bn_gcd.c: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -210,7 +210,7 @@ BIGNUM *BN_mod_inverse(BIGNUM *in, 
	BIGNUM *ret=NULL;

	int sign;



	if (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)

	if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0))

		{

		return BN_mod_inverse_no_branch(in, a, n, ctx);

		}