kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
2637f3c431
boringssl/crypto
History
Adam Langley 696c13bd6a Clear bottom three bits of password scalar in SPAKE2. 
Due to a copy-paste error, the call to |left_shift_3| is missing after
reducing the password scalar in SPAKE2. This means that three bits of
the password leak in Alice's message. (Two in Bob's message as the point
N happens to have order 4l, not 8l.)

The “correct” fix is to put in the missing call to |left_shift_3|, but
that would be a breaking change. In order to fix this in a unilateral
way, we add points of small order to the masking point to bring it into
prime-order subgroup.

BUG=chromium:778101

Change-Id: I440931a3df7f009b324d2a3e3af2d893a101804f
Reviewed-on: https://boringssl-review.googlesource.com/22445
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-10-31 20:58:29 +00:00
..
asn1 asn1_item_embed_new(): don't free an embedded item 2017-10-30 18:51:58 +00:00
base64 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
bio Remove now unnecessary _POSIX_C_SOURCE bits to work around macOS bug. 2017-10-02 20:02:22 +00:00
bn_extra Remove the buggy RSA parser. 2017-10-24 17:39:46 +00:00
buf Always process handshake records in full. 2017-10-17 14:53:11 +00:00
bytestring Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
chacha Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
cipher_extra Explicit fallthrough on switch 2017-09-20 19:58:25 +00:00
cmac Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
conf Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
curve25519 Clear bottom three bits of password scalar in SPAKE2. 2017-10-31 20:58:29 +00:00
dh Fx DH_set0_pqg. 2017-10-05 18:50:48 +00:00
digest_extra Export EVP_parse_digest_algorithm and add EVP_marshal_digest_algorithm. 2017-09-25 20:44:13 +00:00
dsa Switch OPENSSL_VERSION_NUMBER to 1.1.0. 2017-09-29 04:51:27 +00:00
ec_extra Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
ecdh Check EC_POINT/EC_GROUP compatibility more accurately. 2017-10-28 08:02:50 +00:00
ecdsa_extra Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
engine Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
err Add the ability to save and restore the error state. 2017-10-09 21:43:13 +00:00
evp Remove EVP_set_buggy_rsa_parser stub. 2017-10-27 13:49:57 +00:00
fipsmodule Revert assembly changes in "Hide CPU capability symbols in C." 2017-10-30 20:39:57 +00:00
hkdf Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
hmac_extra Convert a number of tests to GTest. 2017-06-01 17:02:13 +00:00
lhash Unexport more of lhash. 2017-10-25 04:17:18 +00:00
obj Switch OPENSSL_VERSION_NUMBER to 1.1.0. 2017-09-29 04:51:27 +00:00
pem Clear some _CRT_SECURE_NO_WARNINGS warnings. 2017-10-25 04:14:28 +00:00
perlasm Revert assembly changes in "Hide CPU capability symbols in C." 2017-10-30 20:39:57 +00:00
pkcs7 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
pkcs8 Export EVP_parse_digest_algorithm and add EVP_marshal_digest_algorithm. 2017-09-25 20:44:13 +00:00
poly1305 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
pool Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
rand_extra Remove CHROMIUM_ROLLING_MAGENTA_TO_ZIRCON scaffolding. 2017-09-18 21:34:32 +00:00
rc4 Simplify RC4 code and remove assembly. 2016-08-30 15:32:31 +00:00
rsa_extra Remove the buggy RSA parser. 2017-10-24 17:39:46 +00:00
stack Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
test Clarify ERR_print_errors_* clear the error queue. 2017-09-05 17:31:25 +00:00
x509 Unexport more of lhash. 2017-10-25 04:17:18 +00:00
x509v3 Fix memory leak in GENERAL_NAME_set0_othername. 2017-10-30 18:40:17 +00:00
CMakeLists.txt Always process handshake records in full. 2017-10-17 14:53:11 +00:00
compiler_test.cc Test that nullptr has the obvious memory representation. 2017-07-28 17:39:28 +00:00
constant_time_test.cc Switch constant-time functions to using |crypto_word_t|. 2017-04-21 22:06:05 +00:00
cpu-aarch64-linux.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
cpu-arm-linux.c Add CRYPTO_needs_hwcap2_workaround. 2017-09-18 14:05:46 +00:00
cpu-arm.c
cpu-intel.c Use unsigned integers for masks. 2017-10-30 18:39:58 +00:00
cpu-ppc64le.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
crypto.c Hide CPU capability symbols in C. 2017-10-23 18:36:49 +00:00
ex_data.c Unexport more of lhash. 2017-10-25 04:17:18 +00:00
internal.h Tidy up alignof #defines. 2017-09-25 14:20:54 +00:00
mem.c Remove now unnecessary _POSIX_C_SOURCE bits to work around macOS bug. 2017-10-02 20:02:22 +00:00
refcount_c11.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_lock.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_test.cc Convert various tests to GTest. 2017-05-23 22:34:09 +00:00
thread_none.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_pthread.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_test.cc Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_win.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread.c