kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
2d07d30c44
boringssl/crypto/curve25519
History
Adam Langley 696c13bd6a Clear bottom three bits of password scalar in SPAKE2. 
Due to a copy-paste error, the call to |left_shift_3| is missing after
reducing the password scalar in SPAKE2. This means that three bits of
the password leak in Alice's message. (Two in Bob's message as the point
N happens to have order 4l, not 8l.)

The “correct” fix is to put in the missing call to |left_shift_3|, but
that would be a breaking change. In order to fix this in a unilateral
way, we add points of small order to the masking point to bring it into
prime-order subgroup.

BUG=chromium:778101

Change-Id: I440931a3df7f009b324d2a3e3af2d893a101804f
Reviewed-on: https://boringssl-review.googlesource.com/22445
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-10-31 20:58:29 +00:00
..
asm Improve Curve25519 cswap x64 assembly 2017-05-23 22:51:48 +00:00
CMakeLists.txt Convert ed25519_test to GTest. 2017-05-23 22:33:55 +00:00
curve25519.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
ed25519_test.cc Convert ed25519_test to GTest. 2017-05-23 22:33:55 +00:00
ed25519_tests.txt Import additional test vectors from RFC 8032. 2017-03-30 16:28:55 +00:00
internal.h Clear bottom three bits of password scalar in SPAKE2. 2017-10-31 20:58:29 +00:00
spake25519_test.cc Clear bottom three bits of password scalar in SPAKE2. 2017-10-31 20:58:29 +00:00
spake25519.c Clear bottom three bits of password scalar in SPAKE2. 2017-10-31 20:58:29 +00:00
x25519_test.cc Convert x25519_test to GTest. 2017-03-01 21:46:11 +00:00
x25519-x86_64.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00