[src/trunk]: src/external/bsd/wpa/dist/src/eap_common EAP-pwd: Run through pr...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/38b6f6e4bade
branches:  trunk
changeset: 463105:38b6f6e4bade
user:      christos <christos%NetBSD.org@localhost>
date:      Thu Aug 08 09:56:41 2019 +0000

description:
EAP-pwd: Run through prf result processing even if it >= prime

This reduces differences in timing and memory access within the
hunting-and-pecking loop for ECC groups that have a prime that is not
close to a power of two (e.g., Brainpool curves).

Signed-off-by: Jouni Malinen <j%w1.fi@localhost>
(cherry picked from commit cd803299ca485eb857e37c88f973fccfbb8600e5)

diffstat:

 external/bsd/wpa/dist/src/eap_common/eap_pwd_common.c |  13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diffs (37 lines):

diff -r 618e89034308 -r 38b6f6e4bade external/bsd/wpa/dist/src/eap_common/eap_pwd_common.c
--- a/external/bsd/wpa/dist/src/eap_common/eap_pwd_common.c     Thu Aug 08 09:56:10 2019 +0000
+++ b/external/bsd/wpa/dist/src/eap_common/eap_pwd_common.c     Thu Aug 08 09:56:41 2019 +0000
@@ -142,6 +142,8 @@
        struct crypto_bignum *x_candidate = NULL, *cofactor = NULL;
        const struct crypto_bignum *prime;
        u8 mask, found_ctr = 0, is_odd = 0;
+       int cmp_prime;
+       unsigned int in_range;
 
        if (grp->pwe)
                return -1;
@@ -234,8 +236,13 @@
                if (primebitlen % 8)
                        buf_shift_right(prfbuf, primebytelen,
                                        8 - primebitlen % 8);
-               if (const_time_memcmp(prfbuf, prime_bin, primebytelen) >= 0)
-                       continue;
+               cmp_prime = const_time_memcmp(prfbuf, prime_bin, primebytelen);
+               /* Create a const_time mask for selection based on prf result
+                * being smaller than prime. */
+               in_range = const_time_fill_msb((unsigned int) cmp_prime);
+               /* The algorithm description would skip the next steps if
+                * cmp_prime >= 0, but go through them regardless to minimize
+                * externally observable differences in behavior. */
 
                crypto_bignum_deinit(x_candidate, 1);
                x_candidate = crypto_bignum_init_set(prfbuf, primebytelen);
@@ -298,7 +305,7 @@
                        goto fail;
                mask = const_time_eq(res, check);
                found_ctr = const_time_select_u8(found, found_ctr, ctr);
-               found |= mask;
+               found |= mask & in_range;
        }
        if (found == 0) {
                wpa_printf(MSG_INFO,