[src/netbsd-3-0]: src/crypto/dist/openssl/crypto/bn Pull up revision 1.2 (via...

[jdc <jdc%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ad3829db12fd
branches:  netbsd-3-0
changeset: 579483:ad3829db12fd
user:      jdc <jdc%NetBSD.org@localhost>
date:      Tue May 13 06:26:26 2008 +0000

description:
Pull up revision 1.2 (via patch), requested by adrianp in ticket #1931).

Fix for CVE-2007-3108

The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL 0.9.8e and
earlier does not properly perform Montgomery multiplication, which might
allow local users to conduct a side-channel attack and retrieve RSA
private keys.

diffstat:

 crypto/dist/openssl/crypto/bn/bn_mont.c |  80 +++++++++++++++++++++++++++-----
 1 files changed, 66 insertions(+), 14 deletions(-)

diffs (118 lines):

diff -r 2363edf056e6 -r ad3829db12fd crypto/dist/openssl/crypto/bn/bn_mont.c
--- a/crypto/dist/openssl/crypto/bn/bn_mont.c   Sun May 11 07:25:33 2008 +0000
+++ b/crypto/dist/openssl/crypto/bn/bn_mont.c   Tue May 13 06:26:26 2008 +0000
@@ -122,7 +122,6 @@
 
        max=(nl+al+1); /* allow for overflow (no?) XXX */
        if (bn_wexpand(r,max) == NULL) goto err;
-       if (bn_wexpand(ret,max) == NULL) goto err;
 
        r->neg=a->neg^n->neg;
        np=n->d;
@@ -173,20 +172,70 @@
                        }
                }
        bn_fix_top(r);
-       
-       /* mont->ri will be a multiple of the word size */
-#if 0
-       BN_rshift(ret,r,mont->ri);
-#else
-       ret->neg = r->neg;
-       x=ri;
+
+       /* mont->ri will be a multiple of the word size and below code
+        * is kind of BN_rshift(ret,r,mont->ri) equivalent */
+       if (r->top <= ri)
+               {
+               ret->top=0;
+               retn=1;
+               goto err;
+               }
+       al=r->top-ri;
+
+# if BRANCH_FREE
+       if (bn_wexpand(ret,ri) == NULL) goto err;
+       x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
+       ret->top=x=(ri&~x)|(al&x);      /* min(ri,al) */
+       ret->neg=r->neg;
+
        rp=ret->d;
-       ap= &(r->d[x]);
-       if (r->top < x)
-               al=0;
-       else
-               al=r->top-x;
+       ap=&(r->d[ri]);
+
+       {
+       size_t m1,m2;
+
+       v=bn_sub_words(rp,ap,np,ri);
+       /* this ----------------^^ works even in al<ri case
+        * thanks to zealous zeroing of top of the vector in the
+        * beginning. */
+
+       /* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
+       /* in other words if subtraction result is real, then
+        * trick unconditional memcpy below to perform in-place
+        * "refresh" instead of actual copy. */
+       m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1);   /* al<ri */
+       m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1);   /* al>ri */
+       m1|=m2;                 /* (al!=ri) */
+       m1|=(0-(size_t)v);      /* (al!=ri || v) */
+       m1&=~m2;                /* (al!=ri || v) && !al>ri */
+       nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1));
+       }
+
+       /* 'i<ri' is chosen to eliminate dependency on input data, even
+        * though it results in redundant copy in al<ri case. */
+       for (i=0,ri-=4; i<ri; i+=4)
+               {
+               BN_ULONG t1,t2,t3,t4;
+
+               t1=nrp[i+0];
+               t2=nrp[i+1];
+               t3=nrp[i+2];    ap[i+0]=0;
+               t4=nrp[i+3];    ap[i+1]=0;
+               rp[i+0]=t1;     ap[i+2]=0;
+               rp[i+1]=t2;     ap[i+3]=0;
+               rp[i+2]=t3;
+               rp[i+3]=t4;
+               }
+       for (ri+=4; i<ri; i++)
+               rp[i]=nrp[i], ap[i]=0;
+# else
+       if (bn_wexpand(ret,al) == NULL) goto err;
        ret->top=al;
+       ret->neg=r->neg;
+
+       rp=ret->d;
+       ap=&(r->d[ri]);
        al-=4;
        for (i=0; i<al; i+=4)
                {
@@ -204,7 +253,7 @@
        al+=4;
        for (; i<al; i++)
                rp[i]=ap[i];
-#endif
+# endif
 #else /* !MONT_WORD */ 
        BIGNUM *t1,*t2;
 
@@ -224,11 +273,14 @@
        if (!BN_rshift(ret,t2,mont->ri)) goto err;
 #endif /* MONT_WORD */
 
+#if !defined(BRANCH_FREE) || BRANCH_FREE==0
        if (BN_ucmp(ret, &(mont->N)) >= 0)
                {
                if (!BN_usub(ret,ret,&(mont->N))) goto err;
                }
+#endif
        retn=1;
+       bn_check_top(ret);
  err:
        BN_CTX_end(ctx);
        return(retn);