kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
c1eef7f795
boringssl/crypto/dsa/dsa.c

982 lines
24 KiB
C
Raw Normal View History

Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
* This package is an SSL implementation written
* by Eric Young (eay@cryptsoft.com).
* The implementation was written so as to conform with Netscapes SSL.
*
* This library is free for commercial and non-commercial use as long as
* the following conditions are aheared to. The following conditions
* apply to all code found in this distribution, be it the RC4, RSA,
* lhash, DES, etc., code; not just the SSL code. The SSL documentation
* included with this distribution is covered by the same copyright terms
* except that the holder is Tim Hudson (tjh@cryptsoft.com).
*
* Copyright remains Eric Young's, and as such any Copyright notices in
* the code are not to be removed.
* If this package is used in a product, Eric Young should be given attribution
* as the author of the parts of the library used.
* This can be in the form of a textual message at program startup or
* in documentation (online or textual) provided with the package.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* "This product includes cryptographic software written by
* Eric Young (eay@cryptsoft.com)"
* The word 'cryptographic' can be left out if the rouines from the library
* being used are not cryptographic related :-).
* 4. If you include any Windows specific code (or a derivative thereof) from
* the apps directory (application code) you must include an acknowledgement:
* "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
*
* THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* The licence and distribution terms for any publically available version or
* derivative of this code cannot be changed. i.e. this code cannot simply be
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*
* The DSS routines are based on patches supplied by
* Steven Schoch <schoch@sheba.arc.nasa.gov>. */
#include <openssl/dsa.h>
Remove string.h from base.h. Including string.h in base.h causes any file that includes a BoringSSL header to include string.h. Generally this wouldn't be a problem, although string.h might slow down the compile if it wasn't otherwise needed. However, it also causes problems for ipsec-tools in Android because OpenSSL didn't have this behaviour. This change removes string.h from base.h and, instead, adds it to each .c file that requires it. Change-Id: I5968e50b0e230fd3adf9b72dd2836e6f52d6fb37 Reviewed-on: https://boringssl-review.googlesource.com/3200 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-31 01:08:37 +00:00
#include <string.h>
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
#include <openssl/bn.h>
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
#include <openssl/dh.h>
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
#include <openssl/digest.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
#include <openssl/engine.h>
#include <openssl/err.h>
#include <openssl/ex_data.h>
#include <openssl/mem.h>
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
#include <openssl/rand.h>
#include <openssl/sha.h>
Eliminate unnecessary includes from low-level crypto modules. Beyond generally eliminating unnecessary includes, eliminate as many includes of headers that declare/define particularly error-prone functionality like strlen, malloc, and free. crypto/err/internal.h was added to remove the dependency on openssl/thread.h from the public openssl/err.h header. The include of <stdlib.h> in openssl/mem.h was retained since it defines OPENSSL_malloc and friends as macros around the stdlib.h functions. The public x509.h, x509v3.h, and ssl.h headers were not changed in order to minimize breakage of source compatibility with external code. Change-Id: I0d264b73ad0a720587774430b2ab8f8275960329 Reviewed-on: https://boringssl-review.googlesource.com/4220 Reviewed-by: Adam Langley <agl@google.com>
2015-03-28 07:12:01 +00:00
#include <openssl/thread.h>
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Move bn/ into crypto/fipsmodule/ Change-Id: I68aa4a740ee1c7f2a308a6536f408929f15b694c Reviewed-on: https://boringssl-review.googlesource.com/15647 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-04-28 22:47:06 +01:00
#include "../fipsmodule/bn/internal.h"
Convert BN_MONT_CTX to new-style locking. This introduces a per-RSA/DSA/DH lock. This is good for lock contention, although pthread locks are depressingly bloated. Change-Id: I07c4d1606fc35135fc141ebe6ba904a28c8f8a0c Reviewed-on: https://boringssl-review.googlesource.com/4324 Reviewed-by: Adam Langley <agl@google.com>
2015-04-13 19:04:14 +01:00
#include "../internal.h"
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove string.h from base.h. Including string.h in base.h causes any file that includes a BoringSSL header to include string.h. Generally this wouldn't be a problem, although string.h might slow down the compile if it wasn't otherwise needed. However, it also causes problems for ipsec-tools in Android because OpenSSL didn't have this behaviour. This change removes string.h from base.h and, instead, adds it to each .c file that requires it. Change-Id: I5968e50b0e230fd3adf9b72dd2836e6f52d6fb37 Reviewed-on: https://boringssl-review.googlesource.com/3200 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-31 01:08:37 +00:00
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
#define OPENSSL_DSA_MAX_MODULUS_BITS 10000
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Primality test according to FIPS PUB 186[-1], Appendix 2.1: 50 rounds of
// Rabin-Miller
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
#define DSS_prime_checks 50
Remove hash table lookups from ex_data. Instead, each module defines a static CRYPTO_EX_DATA_CLASS to hold the values. This makes CRYPTO_cleanup_all_ex_data a no-op as spreading the CRYPTO_EX_DATA_CLASSes across modules (and across crypto and ssl) makes cleanup slightly trickier. We can make it do something if needbe, but it's probably not worth the trouble. Change-Id: Ib6f6fd39a51d8ba88649f0fa29c66db540610c76 Reviewed-on: https://boringssl-review.googlesource.com/4375 Reviewed-by: Adam Langley <agl@google.com>
2015-04-15 22:29:53 +01:00
Remove DSA_sign_setup too. Change-Id: Ib406e7d1653fa57a863dbd5d4eb04401caf5de0a Reviewed-on: https://boringssl-review.googlesource.com/23284 Reviewed-by: Adam Langley <agl@google.com>
2017-11-21 17:58:36 +00:00
static int dsa_sign_setup(const DSA *dsa, BN_CTX *ctx_in, BIGNUM **out_kinv,
BIGNUM **out_r);
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
static CRYPTO_EX_DATA_CLASS g_ex_data_class = CRYPTO_EX_DATA_CLASS_INIT;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
DSA *DSA_new(void) {
Don't cast |OPENSSL_malloc|/|OPENSSL_realloc| result. C has implicit conversion of |void *| to other pointer types so these casts are unnecessary. Clean them up to make the code easier to read and to make it easier to find dangerous casts. Change-Id: I26988a672e8ed4d69c75cfbb284413999b475464 Reviewed-on: https://boringssl-review.googlesource.com/7102 Reviewed-by: David Benjamin <davidben@google.com>
2016-02-07 19:36:04 +00:00
DSA *dsa = OPENSSL_malloc(sizeof(DSA));
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
if (dsa == NULL) {
Remove the func parameter to OPENSSL_PUT_ERROR. Much of this was done automatically with find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' find . -name '*.c' | xargs sed -E -i '' -e 's/(OPENSSL_PUT_ERROR\([a-zA-Z_0-9]+, )[a-zA-Z_0-9]+, ([a-zA-Z_0-9]+\);)/\1\2/' BUG=468039 Change-Id: I4c75fd95dff85ab1d4a546b05e6aed1aeeb499d8 Reviewed-on: https://boringssl-review.googlesource.com/5276 Reviewed-by: Adam Langley <agl@google.com>
2015-06-29 05:28:17 +01:00
OPENSSL_PUT_ERROR(DSA, ERR_R_MALLOC_FAILURE);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return NULL;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memset(dsa, 0, sizeof(DSA));
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
dsa->references = 1;
Compute kinv in DSA with Fermat's Little Theorem. It's a prime, so computing a constant-time mod inverse is straight-forward. Change-Id: Ie09b84363c3d5da827989300a844c470437fd8f2 Reviewed-on: https://boringssl-review.googlesource.com/8308 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 20:13:43 +01:00
CRYPTO_MUTEX_init(&dsa->method_mont_lock);
Remove the CRYPTO_EX_new callback. This callback is never used. The one caller I've ever seen is in Android code which isn't built with BoringSSL and it was a no-op. It also doesn't actually make much sense. A callback cannot reasonably assume that it sees every, say, SSL_CTX created because the index may be registered after the first SSL_CTX is created. Nor is there any point in an EX_DATA consumer in one file knowing about an SSL_CTX created in completely unrelated code. Replace all the pointers with a typedef to int*. This will ensure code which passes NULL or 0 continues to compile while breaking code which passes an actual function. This simplifies some object creation functions which now needn't worry about CRYPTO_new_ex_data failing. (Also avoids bouncing on the lock, but it's taking a read lock, so this doesn't really matter.) BUG=391192 Change-Id: I02893883c6fa8693682075b7b130aa538a0a1437 Reviewed-on: https://boringssl-review.googlesource.com/6625 Reviewed-by: Adam Langley <agl@google.com>
2015-12-05 04:14:35 +00:00
CRYPTO_new_ex_data(&dsa->ex_data);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return dsa;
}
void DSA_free(DSA *dsa) {
if (dsa == NULL) {
return;
}
Convert reference counts in crypto/ This change converts the reference counts in crypto/ to use |CRYPTO_refcount_t|. The reference counts in |X509_PKEY| and |X509_INFO| were never actually used and so were dropped. Change-Id: I75d572cdac1f8c1083c482e29c9519282d7fd16c Reviewed-on: https://boringssl-review.googlesource.com/4772 Reviewed-by: Adam Langley <agl@google.com>
2015-05-15 20:49:30 +01:00
if (!CRYPTO_refcount_dec_and_test_zero(&dsa->references)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return;
}
Remove hash table lookups from ex_data. Instead, each module defines a static CRYPTO_EX_DATA_CLASS to hold the values. This makes CRYPTO_cleanup_all_ex_data a no-op as spreading the CRYPTO_EX_DATA_CLASSes across modules (and across crypto and ssl) makes cleanup slightly trickier. We can make it do something if needbe, but it's probably not worth the trouble. Change-Id: Ib6f6fd39a51d8ba88649f0fa29c66db540610c76 Reviewed-on: https://boringssl-review.googlesource.com/4375 Reviewed-by: Adam Langley <agl@google.com>
2015-04-15 22:29:53 +01:00
CRYPTO_free_ex_data(&g_ex_data_class, dsa, &dsa->ex_data);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Remove unnecessary NULL checks, part 1. First batch of the alphabet. Change-Id: If4e60f4fbb69e04eb4b70aa1b2240e329251bfa5 Reviewed-on: https://boringssl-review.googlesource.com/4514 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 18:50:28 +01:00
BN_clear_free(dsa->p);
BN_clear_free(dsa->q);
BN_clear_free(dsa->g);
BN_clear_free(dsa->pub_key);
BN_clear_free(dsa->priv_key);
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
BN_MONT_CTX_free(dsa->method_mont_p);
Compute kinv in DSA with Fermat's Little Theorem. It's a prime, so computing a constant-time mod inverse is straight-forward. Change-Id: Ie09b84363c3d5da827989300a844c470437fd8f2 Reviewed-on: https://boringssl-review.googlesource.com/8308 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 20:13:43 +01:00
BN_MONT_CTX_free(dsa->method_mont_q);
CRYPTO_MUTEX_cleanup(&dsa->method_mont_lock);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
OPENSSL_free(dsa);
}
int DSA_up_ref(DSA *dsa) {
Convert reference counts in crypto/ This change converts the reference counts in crypto/ to use |CRYPTO_refcount_t|. The reference counts in |X509_PKEY| and |X509_INFO| were never actually used and so were dropped. Change-Id: I75d572cdac1f8c1083c482e29c9519282d7fd16c Reviewed-on: https://boringssl-review.googlesource.com/4772 Reviewed-by: Adam Langley <agl@google.com>
2015-05-15 20:49:30 +01:00
CRYPTO_refcount_inc(&dsa->references);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return 1;
}
Add various 1.1.0 accessors. This gets cURL building against both BoringSSL as it is and BoringSSL with OPENSSL_VERSION_NUMBER set to 1.1.0. BUG=91 Change-Id: I5be73b84df701fe76f3055b1239ae4704a931082 Reviewed-on: https://boringssl-review.googlesource.com/10180 CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Commit-Queue: David Benjamin <davidben@google.com> Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-08-09 16:04:24 +01:00
void DSA_get0_key(const DSA *dsa, const BIGNUM **out_pub_key,
const BIGNUM **out_priv_key) {
if (out_pub_key != NULL) {
*out_pub_key = dsa->pub_key;
}
if (out_priv_key != NULL) {
*out_priv_key = dsa->priv_key;
}
}
void DSA_get0_pqg(const DSA *dsa, const BIGNUM **out_p, const BIGNUM **out_q,
const BIGNUM **out_g) {
if (out_p != NULL) {
*out_p = dsa->p;
}
if (out_q != NULL) {
*out_q = dsa->q;
}
if (out_g != NULL) {
*out_g = dsa->g;
}
}
Switch OPENSSL_VERSION_NUMBER to 1.1.0. Although we are derived from 1.0.2, we mimic 1.1.0 in some ways around our FOO_up_ref functions and opaque libssl types. This causes some difficulties when porting third-party code as any OPENSSL_VERSION_NUMBER checks for 1.1.0 APIs we have will be wrong. Moreover, adding accessors without changing OPENSSL_VERSION_NUMBER can break external projects. It is common to implement a compatibility version of an accessor under #ifdef as a static function. This then conflicts with our headers if we, unlike OpenSSL 1.0.2, have this function. This change switches OPENSSL_VERSION_NUMBER to 1.1.0 and atomically adds enough accessors for software with 1.1.0 support already. The hope is this will unblock hiding SSL_CTX and SSL_SESSION, which will be especially useful with C++-ficiation. The cost is we will hit some growing pains as more 1.1.0 consumers enter the ecosystem and we converge on the right set of APIs to import from upstream. It does not remove any 1.0.2 APIs, so we will not require that all projects support 1.1.0. The exception is APIs which changed in 1.1.0 but did not change the function signature. Those are breaking changes. Specifically: - SSL_CTX_sess_set_get_cb is now const-correct. - X509_get0_signature is now const-correct. For C++ consumers only, this change temporarily includes an overload hack for SSL_CTX_sess_set_get_cb that keeps the old callback working. This is a workaround for Node not yet supporting OpenSSL 1.1.0. The version number is set at (the as yet unreleased) 1.1.0g to denote that this change includes https://github.com/openssl/openssl/pull/4384. Bug: 91 Change-Id: I5eeb27448a6db4c25c244afac37f9604d9608a76 Reviewed-on: https://boringssl-review.googlesource.com/10340 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2016-08-12 19:48:19 +01:00
int DSA_set0_key(DSA *dsa, BIGNUM *pub_key, BIGNUM *priv_key) {
if (dsa->pub_key == NULL && pub_key == NULL) {
return 0;
}
if (pub_key != NULL) {
BN_free(dsa->pub_key);
dsa->pub_key = pub_key;
}
if (priv_key != NULL) {
BN_free(dsa->priv_key);
dsa->priv_key = priv_key;
}
return 1;
}
int DSA_set0_pqg(DSA *dsa, BIGNUM *p, BIGNUM *q, BIGNUM *g) {
if ((dsa->p == NULL && p == NULL) ||
(dsa->q == NULL && q == NULL) ||
(dsa->g == NULL && g == NULL)) {
return 0;
}
if (p != NULL) {
BN_free(dsa->p);
dsa->p = p;
}
if (q != NULL) {
BN_free(dsa->q);
dsa->q = q;
}
if (g != NULL) {
BN_free(dsa->g);
dsa->g = g;
}
return 1;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
int DSA_generate_parameters_ex(DSA *dsa, unsigned bits, const uint8_t *seed_in,
size_t seed_len, int *out_counter,
unsigned long *out_h, BN_GENCB *cb) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
int ok = 0;
unsigned char seed[SHA256_DIGEST_LENGTH];
unsigned char md[SHA256_DIGEST_LENGTH];
unsigned char buf[SHA256_DIGEST_LENGTH], buf2[SHA256_DIGEST_LENGTH];
BIGNUM *r0, *W, *X, *c, *test;
BIGNUM *g = NULL, *q = NULL, *p = NULL;
BN_MONT_CTX *mont = NULL;
int k, n = 0, m = 0;
unsigned i;
int counter = 0;
int r = 0;
BN_CTX *ctx = NULL;
unsigned int h = 2;
unsigned qsize;
const EVP_MD *evpmd;
evpmd = (bits >= 2048) ? EVP_sha256() : EVP_sha1();
qsize = EVP_MD_size(evpmd);
if (bits < 512) {
bits = 512;
}
bits = (bits + 63) / 64 * 64;
if (seed_in != NULL) {
if (seed_len < (size_t)qsize) {
return 0;
}
if (seed_len > (size_t)qsize) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Only consume as much seed as is expected.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
seed_len = qsize;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(seed, seed_in, seed_len);
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
}
ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
}
BN_CTX_start(ctx);
r0 = BN_CTX_get(ctx);
g = BN_CTX_get(ctx);
W = BN_CTX_get(ctx);
q = BN_CTX_get(ctx);
X = BN_CTX_get(ctx);
c = BN_CTX_get(ctx);
p = BN_CTX_get(ctx);
test = BN_CTX_get(ctx);
if (test == NULL || !BN_lshift(test, BN_value_one(), bits - 1)) {
goto err;
}
for (;;) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Find q.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
for (;;) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 1
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_GENCB_call(cb, 0, m++)) {
goto err;
}
int use_random_seed = (seed_in == NULL);
if (use_random_seed) {
if (!RAND_bytes(seed, qsize)) {
goto err;
}
} else {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// If we come back through, use random seed next time.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
seed_in = NULL;
}
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
OPENSSL_memcpy(buf, seed, qsize);
OPENSSL_memcpy(buf2, seed, qsize);
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// precompute "SEED + 1" for step 7:
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
for (i = qsize - 1; i < qsize; i--) {
buf[i]++;
if (buf[i] != 0) {
break;
}
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 2
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!EVP_Digest(seed, qsize, md, NULL, evpmd, NULL) ||
!EVP_Digest(buf, qsize, buf2, NULL, evpmd, NULL)) {
goto err;
}
for (i = 0; i < qsize; i++) {
md[i] ^= buf2[i];
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 3
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
md[0] |= 0x80;
md[qsize - 1] |= 0x01;
if (!BN_bin2bn(md, qsize, q)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 4
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
r = BN_is_prime_fasttest_ex(q, DSS_prime_checks, ctx, use_random_seed, cb);
if (r > 0) {
break;
}
if (r != 0) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// do a callback call
// step 5
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
}
if (!BN_GENCB_call(cb, 2, 0) || !BN_GENCB_call(cb, 3, 0)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 6
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
counter = 0;
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// "offset = 2"
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
n = (bits - 1) / 160;
for (;;) {
if ((counter != 0) && !BN_GENCB_call(cb, 0, counter)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 7
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
BN_zero(W);
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// now 'buf' contains "SEED + offset - 1"
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
for (k = 0; k <= n; k++) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// obtain "SEED + offset + k" by incrementing:
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
for (i = qsize - 1; i < qsize; i--) {
buf[i]++;
if (buf[i] != 0) {
break;
}
}
if (!EVP_Digest(buf, qsize, md, NULL, evpmd, NULL)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 8
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_bin2bn(md, qsize, r0) ||
!BN_lshift(r0, r0, (qsize << 3) * k) ||
!BN_add(W, W, r0)) {
goto err;
}
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// more of step 8
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_mask_bits(W, bits - 1) ||
!BN_copy(X, W) ||
!BN_add(X, X, test)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 9
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_lshift1(r0, q) ||
!BN_mod(c, X, r0, ctx) ||
!BN_sub(r0, c, BN_value_one()) ||
!BN_sub(p, X, r0)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 10
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (BN_cmp(p, test) >= 0) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 11
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
r = BN_is_prime_fasttest_ex(p, DSS_prime_checks, ctx, 1, cb);
if (r > 0) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
goto end; // found it
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
}
if (r != 0) {
goto err;
}
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 13
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
counter++;
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// "offset = offset + n + 1"
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// step 14
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (counter >= 4096) {
break;
}
}
}
end:
if (!BN_GENCB_call(cb, 2, 1)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// We now need to generate g
// Set r0=(p-1)/q
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_sub(test, p, BN_value_one()) ||
!BN_div(r0, NULL, test, q, ctx)) {
goto err;
}
Add a function which folds BN_MONT_CTX_{new,set} together. These empty states aren't any use to either caller or implementor. Change-Id: If0b748afeeb79e4a1386182e61c5b5ecf838de62 Reviewed-on: https://boringssl-review.googlesource.com/25254 Reviewed-by: Adam Langley <agl@google.com>
2018-01-23 22:03:26 +00:00
mont = BN_MONT_CTX_new_for_modulus(p, ctx);
if (mont == NULL ||
!BN_set_word(test, h)) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
goto err;
}
for (;;) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// g=test^r0%p
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_mod_exp_mont(g, test, r0, p, ctx, mont)) {
goto err;
}
if (!BN_is_one(g)) {
break;
}
if (!BN_add(test, test, BN_value_one())) {
goto err;
}
h++;
}
if (!BN_GENCB_call(cb, 3, 1)) {
goto err;
}
ok = 1;
err:
if (ok) {
BN_free(dsa->p);
BN_free(dsa->q);
BN_free(dsa->g);
dsa->p = BN_dup(p);
dsa->q = BN_dup(q);
dsa->g = BN_dup(g);
if (dsa->p == NULL || dsa->q == NULL || dsa->g == NULL) {
ok = 0;
goto err;
}
if (out_counter != NULL) {
*out_counter = counter;
}
if (out_h != NULL) {
*out_h = h;
}
}
if (ctx) {
BN_CTX_end(ctx);
BN_CTX_free(ctx);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
BN_MONT_CTX_free(mont);
return ok;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Reimplement DSA parsing logic with crypto/asn1. Functions which lose object reuse and need auditing: - d2i_DSA_SIG - d2i_DSAPublicKey - d2i_DSAPrivateKey - d2i_DSAparams BUG=499653 Change-Id: I1cc2ae10e1e77eb57da3a858ac8734a95715ce4b Reviewed-on: https://boringssl-review.googlesource.com/7022 Reviewed-by: Adam Langley <agl@google.com>
2016-01-30 06:51:01 +00:00
DSA *DSAparams_dup(const DSA *dsa) {
DSA *ret = DSA_new();
if (ret == NULL) {
return NULL;
}
ret->p = BN_dup(dsa->p);
ret->q = BN_dup(dsa->q);
ret->g = BN_dup(dsa->g);
if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
DSA_free(ret);
return NULL;
}
return ret;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
int DSA_generate_key(DSA *dsa) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
int ok = 0;
BN_CTX *ctx = NULL;
BIGNUM *pub_key = NULL, *priv_key = NULL;
ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
}
priv_key = dsa->priv_key;
if (priv_key == NULL) {
priv_key = BN_new();
if (priv_key == NULL) {
goto err;
}
}
Add BN_rand_range_ex and use internally. There are many cases where we need |BN_rand_range| but with a minimum value other than 0. |BN_rand_range_ex| provides that. Change-Id: I564326c9206bf4e20a37414bdbce16a951c148ce Reviewed-on: https://boringssl-review.googlesource.com/8921 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-07-25 21:36:58 +01:00
if (!BN_rand_range_ex(priv_key, 1, dsa->q)) {
goto err;
}
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
pub_key = dsa->pub_key;
if (pub_key == NULL) {
pub_key = BN_new();
if (pub_key == NULL) {
goto err;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
Don't rely on BN_FLG_CONSTTIME in the DSA code. DSA is deprecated, but get this aligned with some of the BN_FLG_CONSTTIME work going on elsewhere. Change-Id: I676ceab298a69362bef1b61d6f597c5c90da2ff0 Reviewed-on: https://boringssl-review.googlesource.com/8309 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 20:18:38 +01:00
if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p, &dsa->method_mont_lock,
dsa->p, ctx) ||
Remove BN_FLG_CONSTTIME. BN_FLG_CONSTTIME is a ridiculous API and easy to mess up (CVE-2016-2178). Instead, code that needs a particular algorithm which preserves secrecy of some arguemnt should call into that algorithm directly. This is never set outside the library and is finally unused within the library! Credit for all this goes almost entirely to Brian Smith. I just took care of the last bits. Note there was one BN_FLG_CONSTTIME check that was still reachable, the BN_mod_inverse in RSA key generation. However, it used the same code in both cases for even moduli and φ(n) is even if n is not a power of two. Traditionally, RSA keys are not powers of two, even though it would make the modular reductions a lot easier. When reviewing, check that I didn't remove a BN_FLG_CONSTTIME that led to a BN_mod_exp(_mont) or BN_mod_inverse call (with the exception of the RSA one mentioned above). They should all go to functions for the algorithms themselves like BN_mod_exp_mont_consttime. This CL shows the checks are a no-op for all our tests: https://boringssl-review.googlesource.com/c/12927/ BUG=125 Change-Id: I19cbb375cc75aac202bd76b51ca098841d84f337 Reviewed-on: https://boringssl-review.googlesource.com/12926 Reviewed-by: Adam Langley <alangley@gmail.com>
2016-12-17 20:25:55 +00:00
!BN_mod_exp_mont_consttime(pub_key, dsa->g, priv_key, dsa->p, ctx,
Don't rely on BN_FLG_CONSTTIME in the DSA code. DSA is deprecated, but get this aligned with some of the BN_FLG_CONSTTIME work going on elsewhere. Change-Id: I676ceab298a69362bef1b61d6f597c5c90da2ff0 Reviewed-on: https://boringssl-review.googlesource.com/8309 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 20:18:38 +01:00
dsa->method_mont_p)) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
goto err;
}
dsa->priv_key = priv_key;
dsa->pub_key = pub_key;
ok = 1;
err:
if (dsa->pub_key == NULL) {
BN_free(pub_key);
}
if (dsa->priv_key == NULL) {
BN_free(priv_key);
}
BN_CTX_free(ctx);
return ok;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
DSA_SIG *DSA_SIG_new(void) {
DSA_SIG *sig;
sig = OPENSSL_malloc(sizeof(DSA_SIG));
if (!sig) {
return NULL;
}
sig->r = NULL;
sig->s = NULL;
return sig;
}
void DSA_SIG_free(DSA_SIG *sig) {
if (!sig) {
return;
}
Remove unnecessary NULL checks, part 1. First batch of the alphabet. Change-Id: If4e60f4fbb69e04eb4b70aa1b2240e329251bfa5 Reviewed-on: https://boringssl-review.googlesource.com/4514 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 18:50:28 +01:00
BN_free(sig->r);
BN_free(sig->s);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
OPENSSL_free(sig);
}
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
// mod_mul_consttime sets |r| to |a| * |b| modulo |mont->N|, treating |a| and
// |b| as secret. This function internally uses Montgomery reduction, but
// neither inputs nor outputs are in Montgomery form.
static int mod_mul_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
const BN_MONT_CTX *mont, BN_CTX *ctx) {
BN_CTX_start(ctx);
BIGNUM *tmp = BN_CTX_get(ctx);
// |BN_mod_mul_montgomery| removes a factor of R, so we cancel it with a
// single |BN_to_montgomery| which adds one factor of R.
int ok = tmp != NULL &&
BN_to_montgomery(tmp, a, mont, ctx) &&
BN_mod_mul_montgomery(r, tmp, b, mont, ctx);
BN_CTX_end(ctx);
return ok;
}
Remove DSA_sign_setup too. Change-Id: Ib406e7d1653fa57a863dbd5d4eb04401caf5de0a Reviewed-on: https://boringssl-review.googlesource.com/23284 Reviewed-by: Adam Langley <agl@google.com>
2017-11-21 17:58:36 +00:00
DSA_SIG *DSA_do_sign(const uint8_t *digest, size_t digest_len, const DSA *dsa) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
BIGNUM *kinv = NULL, *r = NULL, *s = NULL;
BIGNUM m;
BIGNUM xr;
BN_CTX *ctx = NULL;
int reason = ERR_R_BN_LIB;
DSA_SIG *ret = NULL;
BN_init(&m);
BN_init(&xr);
if (!dsa->p || !dsa->q || !dsa->g) {
reason = DSA_R_MISSING_PARAMETERS;
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
// We only support DSA keys that are a multiple of 8 bits. (This is a weaker
// check than the one in |DSA_do_check_signature|, which only allows 160-,
// 224-, and 256-bit keys.
if (BN_num_bits(dsa->q) % 8 != 0) {
reason = DSA_R_BAD_Q_VALUE;
goto err;
}
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
s = BN_new();
if (s == NULL) {
goto err;
}
ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
}
redo:
Remove DSA_sign_setup too. Change-Id: Ib406e7d1653fa57a863dbd5d4eb04401caf5de0a Reviewed-on: https://boringssl-review.googlesource.com/23284 Reviewed-by: Adam Langley <agl@google.com>
2017-11-21 17:58:36 +00:00
if (!dsa_sign_setup(dsa, ctx, &kinv, &r)) {
goto err;
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
}
if (digest_len > BN_num_bytes(dsa->q)) {
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
// If the digest length is greater than the size of |dsa->q| use the
// BN_num_bits(dsa->q) leftmost bits of the digest, see FIPS 186-3, 4.2.
// Note the above check that |dsa->q| is a multiple of 8 bits.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
digest_len = BN_num_bytes(dsa->q);
}
if (BN_bin2bn(digest, digest_len, &m) == NULL) {
goto err;
}
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
// |m| is bounded by 2^(num_bits(q)), which is slightly looser than q. This
// violates |bn_mod_add_consttime| and |mod_mul_consttime|'s preconditions.
// (The underlying algorithms could accept looser bounds, but we reduce for
// simplicity.)
size_t q_width = bn_minimal_width(dsa->q);
if (!bn_resize_words(&m, q_width) ||
!bn_resize_words(&xr, q_width)) {
goto err;
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
}
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
bn_reduce_once_in_place(m.d, 0 /* no carry word */, dsa->q->d,
xr.d /* scratch space */, q_width);
// Compute s = inv(k) (m + xr) mod q. Note |dsa->method_mont_q| is
// initialized by |dsa_sign_setup|.
if (!mod_mul_consttime(&xr, dsa->priv_key, r, dsa->method_mont_q, ctx) ||
!bn_mod_add_consttime(s, &xr, &m, dsa->q, ctx) ||
!mod_mul_consttime(s, s, kinv, dsa->method_mont_q, ctx)) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Redo if r or s is zero as required by FIPS 186-3: this is
// very unlikely.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (BN_is_zero(r) || BN_is_zero(s)) {
goto redo;
}
Fix memory leak in DSA redo case. Found by clang scan-build. Change-Id: I44a9d5ea165ede836c72aed8725d0bb0981b1004 Reviewed-on: https://boringssl-review.googlesource.com/6700 Reviewed-by: Adam Langley <agl@google.com>
2015-12-11 20:29:17 +00:00
ret = DSA_SIG_new();
if (ret == NULL) {
goto err;
}
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
ret->r = r;
ret->s = s;
err:
Fix memory leak in DSA redo case. Found by clang scan-build. Change-Id: I44a9d5ea165ede836c72aed8725d0bb0981b1004 Reviewed-on: https://boringssl-review.googlesource.com/6700 Reviewed-by: Adam Langley <agl@google.com>
2015-12-11 20:29:17 +00:00
if (ret == NULL) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
OPENSSL_PUT_ERROR(DSA, reason);
BN_free(r);
BN_free(s);
}
BN_CTX_free(ctx);
BN_clear_free(&m);
BN_clear_free(&xr);
BN_clear_free(kinv);
return ret;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
int DSA_do_verify(const uint8_t *digest, size_t digest_len, DSA_SIG *sig,
const DSA *dsa) {
Fix DER checks for DSA_check_signature and add tests. DSA_verify and DSA_check_signature didn't share a codepath, so the fix was only applied to the former. Implement verify in terms of check_signature and add tests for bad DER variants. Change-Id: I6577f96b13b57fc89a5308bd8a7c2318defa7ee1 Reviewed-on: https://boringssl-review.googlesource.com/2820 Reviewed-by: Adam Langley <agl@google.com>
2015-01-11 04:37:17 +00:00
int valid;
if (!DSA_do_check_signature(&valid, digest, digest_len, sig, dsa)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return -1;
}
Fix DER checks for DSA_check_signature and add tests. DSA_verify and DSA_check_signature didn't share a codepath, so the fix was only applied to the former. Implement verify in terms of check_signature and add tests for bad DER variants. Change-Id: I6577f96b13b57fc89a5308bd8a7c2318defa7ee1 Reviewed-on: https://boringssl-review.googlesource.com/2820 Reviewed-by: Adam Langley <agl@google.com>
2015-01-11 04:37:17 +00:00
return valid;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
int DSA_do_check_signature(int *out_valid, const uint8_t *digest,
size_t digest_len, DSA_SIG *sig, const DSA *dsa) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
BN_CTX *ctx;
BIGNUM u1, u2, t1;
int ret = 0;
unsigned i;
*out_valid = 0;
if (!dsa->p || !dsa->q || !dsa->g) {
OPENSSL_PUT_ERROR(DSA, DSA_R_MISSING_PARAMETERS);
return 0;
}
i = BN_num_bits(dsa->q);
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
// FIPS 186-3 allows only different sizes for q.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (i != 160 && i != 224 && i != 256) {
OPENSSL_PUT_ERROR(DSA, DSA_R_BAD_Q_VALUE);
return 0;
}
if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
OPENSSL_PUT_ERROR(DSA, DSA_R_MODULUS_TOO_LARGE);
return 0;
}
BN_init(&u1);
BN_init(&u2);
BN_init(&t1);
ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
}
if (BN_is_zero(sig->r) || BN_is_negative(sig->r) ||
BN_ucmp(sig->r, dsa->q) >= 0) {
ret = 1;
goto err;
}
if (BN_is_zero(sig->s) || BN_is_negative(sig->s) ||
BN_ucmp(sig->s, dsa->q) >= 0) {
ret = 1;
goto err;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Calculate W = inv(S) mod Q
// save W in u2
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (BN_mod_inverse(&u2, sig->s, dsa->q, ctx) == NULL) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// save M in u1
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (digest_len > (i >> 3)) {
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// if the digest length is greater than the size of q use the
// BN_num_bits(dsa->q) leftmost bits of the digest, see
// fips 186-3, 4.2
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
digest_len = (i >> 3);
}
if (BN_bin2bn(digest, digest_len, &u1) == NULL) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// u1 = M * w mod q
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_mod_mul(&u1, &u1, &u2, dsa->q, ctx)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// u2 = r * w mod q
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_mod_mul(&u2, sig->r, &u2, dsa->q, ctx)) {
goto err;
}
Make return value of |BN_MONT_CTX_set_locked| int. This reduces the chance of double-frees. BUG=10 Change-Id: I11a240e2ea5572effeddc05acb94db08c54a2e0b Reviewed-on: https://boringssl-review.googlesource.com/7583 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-25 20:11:04 +00:00
if (!BN_MONT_CTX_set_locked((BN_MONT_CTX **)&dsa->method_mont_p,
Compute kinv in DSA with Fermat's Little Theorem. It's a prime, so computing a constant-time mod inverse is straight-forward. Change-Id: Ie09b84363c3d5da827989300a844c470437fd8f2 Reviewed-on: https://boringssl-review.googlesource.com/8308 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 20:13:43 +01:00
(CRYPTO_MUTEX *)&dsa->method_mont_lock, dsa->p,
Make return value of |BN_MONT_CTX_set_locked| int. This reduces the chance of double-frees. BUG=10 Change-Id: I11a240e2ea5572effeddc05acb94db08c54a2e0b Reviewed-on: https://boringssl-review.googlesource.com/7583 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-25 20:11:04 +00:00
ctx)) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
goto err;
}
if (!BN_mod_exp2_mont(&t1, dsa->g, &u1, dsa->pub_key, &u2, dsa->p, ctx,
Make return value of |BN_MONT_CTX_set_locked| int. This reduces the chance of double-frees. BUG=10 Change-Id: I11a240e2ea5572effeddc05acb94db08c54a2e0b Reviewed-on: https://boringssl-review.googlesource.com/7583 Reviewed-by: David Benjamin <davidben@google.com>
2016-03-25 20:11:04 +00:00
dsa->method_mont_p)) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// BN_copy(&u1,&t1);
// let u1 = u1 mod q
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
if (!BN_mod(&u1, &t1, dsa->q, ctx)) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// V is now in u1. If the signature is correct, it will be
// equal to R.
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
*out_valid = BN_ucmp(&u1, sig->r) == 0;
ret = 1;
err:
if (ret != 1) {
OPENSSL_PUT_ERROR(DSA, ERR_R_BN_LIB);
}
BN_CTX_free(ctx);
BN_free(&u1);
BN_free(&u2);
BN_free(&t1);
return ret;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
int DSA_sign(int type, const uint8_t *digest, size_t digest_len,
Remove DSA_sign_setup too. Change-Id: Ib406e7d1653fa57a863dbd5d4eb04401caf5de0a Reviewed-on: https://boringssl-review.googlesource.com/23284 Reviewed-by: Adam Langley <agl@google.com>
2017-11-21 17:58:36 +00:00
uint8_t *out_sig, unsigned int *out_siglen, const DSA *dsa) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
DSA_SIG *s;
s = DSA_do_sign(digest, digest_len, dsa);
if (s == NULL) {
*out_siglen = 0;
return 0;
}
*out_siglen = i2d_DSA_SIG(s, &out_sig);
DSA_SIG_free(s);
return 1;
}
int DSA_verify(int type, const uint8_t *digest, size_t digest_len,
const uint8_t *sig, size_t sig_len, const DSA *dsa) {
Fix DER checks for DSA_check_signature and add tests. DSA_verify and DSA_check_signature didn't share a codepath, so the fix was only applied to the former. Implement verify in terms of check_signature and add tests for bad DER variants. Change-Id: I6577f96b13b57fc89a5308bd8a7c2318defa7ee1 Reviewed-on: https://boringssl-review.googlesource.com/2820 Reviewed-by: Adam Langley <agl@google.com>
2015-01-11 04:37:17 +00:00
int valid;
if (!DSA_check_signature(&valid, digest, digest_len, sig, sig_len, dsa)) {
return -1;
}
return valid;
}
int DSA_check_signature(int *out_valid, const uint8_t *digest,
size_t digest_len, const uint8_t *sig, size_t sig_len,
const DSA *dsa) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
DSA_SIG *s = NULL;
Fix DER checks for DSA_check_signature and add tests. DSA_verify and DSA_check_signature didn't share a codepath, so the fix was only applied to the former. Implement verify in terms of check_signature and add tests for bad DER variants. Change-Id: I6577f96b13b57fc89a5308bd8a7c2318defa7ee1 Reviewed-on: https://boringssl-review.googlesource.com/2820 Reviewed-by: Adam Langley <agl@google.com>
2015-01-11 04:37:17 +00:00
int ret = 0;
Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 (Imported from upstream's 85cfc188c06bd046420ae70dd6e302f9efe022a9 and 4c52816d35681c0533c25fdd3abb4b7c6962302d) Change-Id: Ic901aea8ea6457df27dc542a11c30464561e322b Reviewed-on: https://boringssl-review.googlesource.com/2783 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-08 20:26:55 +00:00
uint8_t *der = NULL;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
s = DSA_SIG_new();
if (s == NULL) {
goto err;
}
Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 (Imported from upstream's 85cfc188c06bd046420ae70dd6e302f9efe022a9 and 4c52816d35681c0533c25fdd3abb4b7c6962302d) Change-Id: Ic901aea8ea6457df27dc542a11c30464561e322b Reviewed-on: https://boringssl-review.googlesource.com/2783 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-08 20:26:55 +00:00
const uint8_t *sigp = sig;
if (d2i_DSA_SIG(&s, &sigp, sig_len) == NULL || sigp != sig + sig_len) {
goto err;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Ensure that the signature uses DER and doesn't have trailing garbage.
Fix various certificate fingerprint issues. By using non-DER or invalid encodings outside the signed portion of a certificate the fingerprint can be changed without breaking the signature. Although no details of the signed portion of the certificate can be changed this can cause problems with some applications: e.g. those using the certificate fingerprint for blacklists. 1. Reject signatures with non zero unused bits. If the BIT STRING containing the signature has non zero unused bits reject the signature. All current signature algorithms require zero unused bits. 2. Check certificate algorithm consistency. Check the AlgorithmIdentifier inside TBS matches the one in the certificate signature. NB: this will result in signature failure errors for some broken certificates. 3. Check DSA/ECDSA signatures use DER. Reencode DSA/ECDSA signatures and compare with the original received signature. Return an error if there is a mismatch. This will reject various cases including garbage after signature (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program for discovering this case) and use of BER or invalid ASN.1 INTEGERs (negative or with leading zeroes). CVE-2014-8275 (Imported from upstream's 85cfc188c06bd046420ae70dd6e302f9efe022a9 and 4c52816d35681c0533c25fdd3abb4b7c6962302d) Change-Id: Ic901aea8ea6457df27dc542a11c30464561e322b Reviewed-on: https://boringssl-review.googlesource.com/2783 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-01-08 20:26:55 +00:00
int der_len = i2d_DSA_SIG(s, &der);
Work around language and compiler bug in memcpy, etc. Most C standard library functions are undefined if passed NULL, even when the corresponding length is zero. This gives them (and, in turn, all functions which call them) surprising behavior on empty arrays. Some compilers will miscompile code due to this rule. See also https://www.imperialviolet.org/2016/06/26/nonnull.html Add OPENSSL_memcpy, etc., wrappers which avoid this problem. BUG=23 Change-Id: I95f42b23e92945af0e681264fffaf578e7f8465e Reviewed-on: https://boringssl-review.googlesource.com/12928 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
2016-12-13 06:07:13 +00:00
if (der_len < 0 || (size_t)der_len != sig_len ||
OPENSSL_memcmp(sig, der, sig_len)) {
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
goto err;
}
Fix DER checks for DSA_check_signature and add tests. DSA_verify and DSA_check_signature didn't share a codepath, so the fix was only applied to the former. Implement verify in terms of check_signature and add tests for bad DER variants. Change-Id: I6577f96b13b57fc89a5308bd8a7c2318defa7ee1 Reviewed-on: https://boringssl-review.googlesource.com/2820 Reviewed-by: Adam Langley <agl@google.com>
2015-01-11 04:37:17 +00:00
ret = DSA_do_check_signature(out_valid, digest, digest_len, s, dsa);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
err:
Remove unnecessary NULL checks, part 1. First batch of the alphabet. Change-Id: If4e60f4fbb69e04eb4b70aa1b2240e329251bfa5 Reviewed-on: https://boringssl-review.googlesource.com/4514 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 18:50:28 +01:00
OPENSSL_free(der);
DSA_SIG_free(s);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return ret;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// der_len_len returns the number of bytes needed to represent a length of |len|
// in DER.
Reimplement DSA_size without crypto/asn1. BUG=499653 Change-Id: I16963fb198609d7fc0df6c57923cda3e13350753 Reviewed-on: https://boringssl-review.googlesource.com/6875 Reviewed-by: Adam Langley <agl@google.com>
2016-01-02 22:35:47 +00:00
static size_t der_len_len(size_t len) {
if (len < 0x80) {
return 1;
}
size_t ret = 1;
while (len > 0) {
ret++;
len >>= 8;
}
return ret;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Reimplement DSA_size without crypto/asn1. BUG=499653 Change-Id: I16963fb198609d7fc0df6c57923cda3e13350753 Reviewed-on: https://boringssl-review.googlesource.com/6875 Reviewed-by: Adam Langley <agl@google.com>
2016-01-02 22:35:47 +00:00
int DSA_size(const DSA *dsa) {
size_t order_len = BN_num_bytes(dsa->q);
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Compute the maximum length of an |order_len| byte integer. Defensively
// assume that the leading 0x00 is included.
Reimplement DSA_size without crypto/asn1. BUG=499653 Change-Id: I16963fb198609d7fc0df6c57923cda3e13350753 Reviewed-on: https://boringssl-review.googlesource.com/6875 Reviewed-by: Adam Langley <agl@google.com>
2016-01-02 22:35:47 +00:00
size_t integer_len = 1 /* tag */ + der_len_len(order_len + 1) + 1 + order_len;
if (integer_len < order_len) {
return 0;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// A DSA signature is two INTEGERs.
Reimplement DSA_size without crypto/asn1. BUG=499653 Change-Id: I16963fb198609d7fc0df6c57923cda3e13350753 Reviewed-on: https://boringssl-review.googlesource.com/6875 Reviewed-by: Adam Langley <agl@google.com>
2016-01-02 22:35:47 +00:00
size_t value_len = 2 * integer_len;
if (value_len < integer_len) {
return 0;
}
Run the comment converter on libcrypto. crypto/{asn1,x509,x509v3,pem} were skipped as they are still OpenSSL style. Change-Id: I3cd9a60e1cb483a981aca325041f3fbce294247c Reviewed-on: https://boringssl-review.googlesource.com/19504 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-08-18 19:06:02 +01:00
// Add the header.
Reimplement DSA_size without crypto/asn1. BUG=499653 Change-Id: I16963fb198609d7fc0df6c57923cda3e13350753 Reviewed-on: https://boringssl-review.googlesource.com/6875 Reviewed-by: Adam Langley <agl@google.com>
2016-01-02 22:35:47 +00:00
size_t ret = 1 /* tag */ + der_len_len(value_len) + value_len;
if (ret < value_len) {
return 0;
}
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
return ret;
}
Remove DSA_sign_setup too. Change-Id: Ib406e7d1653fa57a863dbd5d4eb04401caf5de0a Reviewed-on: https://boringssl-review.googlesource.com/23284 Reviewed-by: Adam Langley <agl@google.com>
2017-11-21 17:58:36 +00:00
static int dsa_sign_setup(const DSA *dsa, BN_CTX *ctx_in, BIGNUM **out_kinv,
BIGNUM **out_r) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
BN_CTX *ctx;
Remove DSA k+q kludge. With fixed-width BIGNUMs, this is no longer a concern. With this CL, I believe we now no longer call BN_num_bits on BIGNUMs with secret magnitude. Of course, DSA then turns around and calls the variable-time BN_mod immediately afterwards anyway. But the DSA is deprecated and doomed to be removed someday anyway. Change-Id: Iac1dab22aa51c0e7f5ca0f7f44a026a242a4eaa2 Reviewed-on: https://boringssl-review.googlesource.com/25284 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-01-25 16:39:22 +00:00
BIGNUM k, *kinv = NULL, *r = NULL;
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
int ret = 0;
if (!dsa->p || !dsa->q || !dsa->g) {
OPENSSL_PUT_ERROR(DSA, DSA_R_MISSING_PARAMETERS);
return 0;
}
BN_init(&k);
ctx = ctx_in;
if (ctx == NULL) {
ctx = BN_CTX_new();
if (ctx == NULL) {
goto err;
}
}
r = BN_new();
Remove DSA k+q kludge. With fixed-width BIGNUMs, this is no longer a concern. With this CL, I believe we now no longer call BN_num_bits on BIGNUMs with secret magnitude. Of course, DSA then turns around and calls the variable-time BN_mod immediately afterwards anyway. But the DSA is deprecated and doomed to be removed someday anyway. Change-Id: Iac1dab22aa51c0e7f5ca0f7f44a026a242a4eaa2 Reviewed-on: https://boringssl-review.googlesource.com/25284 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-01-25 16:39:22 +00:00
kinv = BN_new();
if (r == NULL || kinv == NULL ||
// Get random k
!BN_rand_range_ex(&k, 1, dsa->q) ||
!BN_MONT_CTX_set_locked((BN_MONT_CTX **)&dsa->method_mont_p,
Compute kinv in DSA with Fermat's Little Theorem. It's a prime, so computing a constant-time mod inverse is straight-forward. Change-Id: Ie09b84363c3d5da827989300a844c470437fd8f2 Reviewed-on: https://boringssl-review.googlesource.com/8308 Reviewed-by: Adam Langley <agl@google.com>
2016-06-16 20:13:43 +01:00
(CRYPTO_MUTEX *)&dsa->method_mont_lock, dsa->p,
ctx) ||
!BN_MONT_CTX_set_locked((BN_MONT_CTX **)&dsa->method_mont_q,
(CRYPTO_MUTEX *)&dsa->method_mont_lock, dsa->q,
Remove DSA k+q kludge. With fixed-width BIGNUMs, this is no longer a concern. With this CL, I believe we now no longer call BN_num_bits on BIGNUMs with secret magnitude. Of course, DSA then turns around and calls the variable-time BN_mod immediately afterwards anyway. But the DSA is deprecated and doomed to be removed someday anyway. Change-Id: Iac1dab22aa51c0e7f5ca0f7f44a026a242a4eaa2 Reviewed-on: https://boringssl-review.googlesource.com/25284 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-01-25 16:39:22 +00:00
ctx) ||
// Compute r = (g^k mod p) mod q
!BN_mod_exp_mont_consttime(r, dsa->g, &k, dsa->p, ctx,
dsa->method_mont_p) ||
Fix some timing leaks in the DSA code. The DSA code is deprecated and will, hopefully, be removed in the future. Nonetheless, this is easy enough to fix. It's the analog of the work we'd already done for ECDSA. - Document more clearly that we don't care about the DSA code. - Use the existing constant-time modular addition function rather than the ad-hoc code. - Reduce the digest to satisfy modular operations' invariants. (The underlying algorithms could accept looser bounds, but we reduce for simplicity.) There's no particular reason to do this in constant time, but we have the code for it, so we may as well. - This additionally adds a missing check that num_bits(q) is a multiple of 8. We otherwise don't compute the right answer. Verification already rejected all 160-, 224-, and 256-bit keys, and we only generate DSA parameters where the length of q matches some hash function's length, so this is unlikely to cause anyone trouble. - Use Montgomery reduction to perform the modular multiplication. This could be optimized to save a couple Montgomery reductions as in ECDSA, but DSA is deprecated, so I haven't bothered optimizing this. - The reduction from g^k (mod p) to r = g^k (mod p) (mod q) is left in variable time, but reversing it would require a discrete log anyway. (The corresponding ECDSA operation is much easier to make constant-time due to Hasse's theorem, though that's actually still a TODO. I need to finish lifting EC_FELEM up the stack.) Thanks to Keegan Ryan from NCC Group for reporting the modular addition issue (CVE-2018-0495). The remainder is stuff I noticed along the way. Update-Note: See the num_bits(q) change. Change-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb Reviewed-on: https://boringssl-review.googlesource.com/29145 Commit-Queue: Adam Langley <agl@google.com> Reviewed-by: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-06-07 16:32:15 +01:00
// Note |BN_mod| below is not constant-time and may leak information about
// |r|. |dsa->p| may be significantly larger than |dsa->q|, so this is not
// easily performed in constant-time with Montgomery reduction.
//
// However, |r| at this point is g^k (mod p). It is almost the value of
// |r| revealed in the signature anyway (g^k (mod p) (mod q)), going from
// it to |k| would require computing a discrete log.
Remove DSA k+q kludge. With fixed-width BIGNUMs, this is no longer a concern. With this CL, I believe we now no longer call BN_num_bits on BIGNUMs with secret magnitude. Of course, DSA then turns around and calls the variable-time BN_mod immediately afterwards anyway. But the DSA is deprecated and doomed to be removed someday anyway. Change-Id: Iac1dab22aa51c0e7f5ca0f7f44a026a242a4eaa2 Reviewed-on: https://boringssl-review.googlesource.com/25284 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2018-01-25 16:39:22 +00:00
!BN_mod(r, r, dsa->q, ctx) ||
// Compute part of 's = inv(k) (m + xr) mod q' using Fermat's Little
// Theorem.
Don't use BN_mod_inverse for inverses mod p in RSA keygen. Instead, use BN_mod_exp_mont_consttime of p - 2. This removes two more call sites sensitive to BN_FLG_CONSTTIME. We're down to just that last BN_mod_inverse modulo φ(n). (Sort of. It's actually not sensitive because even mod inverses always hit the other codepath. Perhaps we should just leave it alone.) Note this comes with a slight behavior change. The BN_MONT_CTXs are initialized a little earlier. If a caller calls RSA_generate_* and then reaches into the struct to scrap all the fields on it, they'll get confused. Before, they had to perform an operation on it to get confused. This is a completely ridiculous thing to do. Since we do this a lot, this introduces some convenience functions for doing the Fermat's Little Theorem mod inverse and fixes a leak in the DSA code should computing kinv hit a malloc error. BUG=125 Change-Id: Iafcae2fc6fd379d161f015c90ff7050e2282e905 Reviewed-on: https://boringssl-review.googlesource.com/12925 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-17 19:27:16 +00:00
!bn_mod_inverse_prime(kinv, &k, dsa->q, ctx, dsa->method_mont_q)) {
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
goto err;
}
BN_clear_free(*out_kinv);
*out_kinv = kinv;
kinv = NULL;
BN_clear_free(*out_r);
*out_r = r;
ret = 1;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
err:
if (!ret) {
OPENSSL_PUT_ERROR(DSA, ERR_R_BN_LIB);
if (r != NULL) {
BN_clear_free(r);
}
}
if (ctx_in == NULL) {
BN_CTX_free(ctx);
}
BN_clear_free(&k);
Don't use BN_mod_inverse for inverses mod p in RSA keygen. Instead, use BN_mod_exp_mont_consttime of p - 2. This removes two more call sites sensitive to BN_FLG_CONSTTIME. We're down to just that last BN_mod_inverse modulo φ(n). (Sort of. It's actually not sensitive because even mod inverses always hit the other codepath. Perhaps we should just leave it alone.) Note this comes with a slight behavior change. The BN_MONT_CTXs are initialized a little earlier. If a caller calls RSA_generate_* and then reaches into the struct to scrap all the fields on it, they'll get confused. Before, they had to perform an operation on it to get confused. This is a completely ridiculous thing to do. Since we do this a lot, this introduces some convenience functions for doing the Fermat's Little Theorem mod inverse and fixes a leak in the DSA code should computing kinv hit a malloc error. BUG=125 Change-Id: Iafcae2fc6fd379d161f015c90ff7050e2282e905 Reviewed-on: https://boringssl-review.googlesource.com/12925 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2016-12-17 19:27:16 +00:00
BN_clear_free(kinv);
Unwind DH_METHOD and DSA_METHOD. This will allow a static linker (with -ffunction-sections since things aren't split into files) to drop unused parts of DH and DSA. Notably, the parameter generation bits pull in primality-checking code. Change-Id: I25087e4cb91bc9d0ab43bcb267c2e2c164e56b59 Reviewed-on: https://boringssl-review.googlesource.com/6388 Reviewed-by: Adam Langley <agl@google.com>
2015-10-30 20:53:00 +00:00
return ret;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Remove the CRYPTO_EX_new callback. This callback is never used. The one caller I've ever seen is in Android code which isn't built with BoringSSL and it was a no-op. It also doesn't actually make much sense. A callback cannot reasonably assume that it sees every, say, SSL_CTX created because the index may be registered after the first SSL_CTX is created. Nor is there any point in an EX_DATA consumer in one file knowing about an SSL_CTX created in completely unrelated code. Replace all the pointers with a typedef to int*. This will ensure code which passes NULL or 0 continues to compile while breaking code which passes an actual function. This simplifies some object creation functions which now needn't worry about CRYPTO_new_ex_data failing. (Also avoids bouncing on the lock, but it's taking a read lock, so this doesn't really matter.) BUG=391192 Change-Id: I02893883c6fa8693682075b7b130aa538a0a1437 Reviewed-on: https://boringssl-review.googlesource.com/6625 Reviewed-by: Adam Langley <agl@google.com>
2015-12-05 04:14:35 +00:00
int DSA_get_ex_new_index(long argl, void *argp, CRYPTO_EX_unused *unused,
Remove ex_data's dup hook. The only place it is used is EC_KEY_{dup,copy} and no one calls that function on an EC_KEY with ex_data. This aligns with functions like RSAPublicKey_dup which do not copy ex_data. The logic is also somewhat subtle in the face of malloc errors (upstream's PR 3323). In fact, we'd even changed the function pointer signature from upstream, so BoringSSL-only code is needed to pass this pointer in anyway. (I haven't switched it to CRYPTO_EX_unused because there are some callers which pass in an implementation anyway.) Note, in upstream, the dup hook is also used for SSL_SESSIONs when those are duplicated (for TLS 1.2 ticket renewal or TLS 1.3 resumption). Our interpretation is that callers should treat those SSL_SESSIONs equivalently to newly-established ones. This avoids every consumer providing a dup hook and simplifies the interface. (I've gone ahead and removed the TODO(fork). I don't think we'll be able to change this API. Maybe introduce a new one, but it may not be worth it? Then again, this API is atrocious... I've never seen anyone use argl and argp even.) BUG=21 Change-Id: I6c9e9d5a02347cb229d4c084c1e85125bd741d2b Reviewed-on: https://boringssl-review.googlesource.com/16344 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-05-14 22:10:18 +01:00
CRYPTO_EX_dup *dup_unused, CRYPTO_EX_free *free_func) {
Remove hash table lookups from ex_data. Instead, each module defines a static CRYPTO_EX_DATA_CLASS to hold the values. This makes CRYPTO_cleanup_all_ex_data a no-op as spreading the CRYPTO_EX_DATA_CLASSes across modules (and across crypto and ssl) makes cleanup slightly trickier. We can make it do something if needbe, but it's probably not worth the trouble. Change-Id: Ib6f6fd39a51d8ba88649f0fa29c66db540610c76 Reviewed-on: https://boringssl-review.googlesource.com/4375 Reviewed-by: Adam Langley <agl@google.com>
2015-04-15 22:29:53 +01:00
int index;
Remove ex_data's dup hook. The only place it is used is EC_KEY_{dup,copy} and no one calls that function on an EC_KEY with ex_data. This aligns with functions like RSAPublicKey_dup which do not copy ex_data. The logic is also somewhat subtle in the face of malloc errors (upstream's PR 3323). In fact, we'd even changed the function pointer signature from upstream, so BoringSSL-only code is needed to pass this pointer in anyway. (I haven't switched it to CRYPTO_EX_unused because there are some callers which pass in an implementation anyway.) Note, in upstream, the dup hook is also used for SSL_SESSIONs when those are duplicated (for TLS 1.2 ticket renewal or TLS 1.3 resumption). Our interpretation is that callers should treat those SSL_SESSIONs equivalently to newly-established ones. This avoids every consumer providing a dup hook and simplifies the interface. (I've gone ahead and removed the TODO(fork). I don't think we'll be able to change this API. Maybe introduce a new one, but it may not be worth it? Then again, this API is atrocious... I've never seen anyone use argl and argp even.) BUG=21 Change-Id: I6c9e9d5a02347cb229d4c084c1e85125bd741d2b Reviewed-on: https://boringssl-review.googlesource.com/16344 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-05-14 22:10:18 +01:00
if (!CRYPTO_get_ex_new_index(&g_ex_data_class, &index, argl, argp,
Remove the CRYPTO_EX_new callback. This callback is never used. The one caller I've ever seen is in Android code which isn't built with BoringSSL and it was a no-op. It also doesn't actually make much sense. A callback cannot reasonably assume that it sees every, say, SSL_CTX created because the index may be registered after the first SSL_CTX is created. Nor is there any point in an EX_DATA consumer in one file knowing about an SSL_CTX created in completely unrelated code. Replace all the pointers with a typedef to int*. This will ensure code which passes NULL or 0 continues to compile while breaking code which passes an actual function. This simplifies some object creation functions which now needn't worry about CRYPTO_new_ex_data failing. (Also avoids bouncing on the lock, but it's taking a read lock, so this doesn't really matter.) BUG=391192 Change-Id: I02893883c6fa8693682075b7b130aa538a0a1437 Reviewed-on: https://boringssl-review.googlesource.com/6625 Reviewed-by: Adam Langley <agl@google.com>
2015-12-05 04:14:35 +00:00
free_func)) {
Remove hash table lookups from ex_data. Instead, each module defines a static CRYPTO_EX_DATA_CLASS to hold the values. This makes CRYPTO_cleanup_all_ex_data a no-op as spreading the CRYPTO_EX_DATA_CLASSes across modules (and across crypto and ssl) makes cleanup slightly trickier. We can make it do something if needbe, but it's probably not worth the trouble. Change-Id: Ib6f6fd39a51d8ba88649f0fa29c66db540610c76 Reviewed-on: https://boringssl-review.googlesource.com/4375 Reviewed-by: Adam Langley <agl@google.com>
2015-04-15 22:29:53 +01:00
return -1;
}
return index;
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Fix miscellaneous clang-tidy warnings. There are still a ton of them, almost exclusively complaints that function declaration and definitions have different parameter names. I just fixed a few randomly. Change-Id: I1072f3dba8f63372cda92425aa94f4aa9e3911fa Reviewed-on: https://boringssl-review.googlesource.com/18706 Reviewed-by: Steven Valdez <svaldez@google.com>
2017-08-01 00:09:42 +01:00
int DSA_set_ex_data(DSA *dsa, int idx, void *arg) {
return CRYPTO_set_ex_data(&dsa->ex_data, idx, arg);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Fix miscellaneous clang-tidy warnings. There are still a ton of them, almost exclusively complaints that function declaration and definitions have different parameter names. I just fixed a few randomly. Change-Id: I1072f3dba8f63372cda92425aa94f4aa9e3911fa Reviewed-on: https://boringssl-review.googlesource.com/18706 Reviewed-by: Steven Valdez <svaldez@google.com>
2017-08-01 00:09:42 +01:00
void *DSA_get_ex_data(const DSA *dsa, int idx) {
return CRYPTO_get_ex_data(&dsa->ex_data, idx);
Inital import. Initial fork from f2d678e6e89b6508147086610e985d4e8416e867 (1.0.2 beta). (This change contains substantial changes from the original and effectively starts a new history.)
2014-06-20 20:00:00 +01:00
}
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
Fix miscellaneous clang-tidy warnings. There are still a ton of them, almost exclusively complaints that function declaration and definitions have different parameter names. I just fixed a few randomly. Change-Id: I1072f3dba8f63372cda92425aa94f4aa9e3911fa Reviewed-on: https://boringssl-review.googlesource.com/18706 Reviewed-by: Steven Valdez <svaldez@google.com>
2017-08-01 00:09:42 +01:00
DH *DSA_dup_DH(const DSA *dsa) {
if (dsa == NULL) {
return NULL;
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
}
Fix miscellaneous clang-tidy warnings. There are still a ton of them, almost exclusively complaints that function declaration and definitions have different parameter names. I just fixed a few randomly. Change-Id: I1072f3dba8f63372cda92425aa94f4aa9e3911fa Reviewed-on: https://boringssl-review.googlesource.com/18706 Reviewed-by: Steven Valdez <svaldez@google.com>
2017-08-01 00:09:42 +01:00
DH *ret = DH_new();
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
if (ret == NULL) {
goto err;
}
Fix miscellaneous clang-tidy warnings. There are still a ton of them, almost exclusively complaints that function declaration and definitions have different parameter names. I just fixed a few randomly. Change-Id: I1072f3dba8f63372cda92425aa94f4aa9e3911fa Reviewed-on: https://boringssl-review.googlesource.com/18706 Reviewed-by: Steven Valdez <svaldez@google.com>
2017-08-01 00:09:42 +01:00
if (dsa->q != NULL) {
ret->priv_length = BN_num_bits(dsa->q);
if ((ret->q = BN_dup(dsa->q)) == NULL) {
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
goto err;
}
}
Fix miscellaneous clang-tidy warnings. There are still a ton of them, almost exclusively complaints that function declaration and definitions have different parameter names. I just fixed a few randomly. Change-Id: I1072f3dba8f63372cda92425aa94f4aa9e3911fa Reviewed-on: https://boringssl-review.googlesource.com/18706 Reviewed-by: Steven Valdez <svaldez@google.com>
2017-08-01 00:09:42 +01:00
if ((dsa->p != NULL && (ret->p = BN_dup(dsa->p)) == NULL) ||
(dsa->g != NULL && (ret->g = BN_dup(dsa->g)) == NULL) ||
(dsa->pub_key != NULL && (ret->pub_key = BN_dup(dsa->pub_key)) == NULL) ||
(dsa->priv_key != NULL &&
(ret->priv_key = BN_dup(dsa->priv_key)) == NULL)) {
goto err;
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
}
return ret;
err:
Remove unnecessary NULL checks, part 1. First batch of the alphabet. Change-Id: If4e60f4fbb69e04eb4b70aa1b2240e329251bfa5 Reviewed-on: https://boringssl-review.googlesource.com/4514 Reviewed-by: Adam Langley <agl@google.com>
2015-04-22 18:50:28 +01:00
DH_free(ret);
Add misc functions for easier porting. Android requested that the wpa_supplicant go upstream. This change adds some dummy functions and reinstates DSA_dup_DH in order to make the diff smaller and easier for upstream. Change-Id: I77ac271b8652bae5a0bbe16afde51d9096f3dfb5 Reviewed-on: https://boringssl-review.googlesource.com/1740 Reviewed-by: Adam Langley <agl@google.com>
2014-09-06 01:04:51 +01:00
return NULL;
}
Reference in New Issue Copy Permalink