kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
a63d0ad40d
boringssl/crypto
History
David Benjamin a63d0ad40d Require BN_mod_exp_mont* inputs be reduced. 
If the caller asked for the base to be treated as secret, we should
provide that. Allowing unbounded inputs is not compatible with being
constant-time.

Additionally, this aligns with the guidance here:
https://github.com/HACS-workshop/spectre-mitigations/blob/master/crypto_guidelines.md#1-do-not-conditionally-choose-between-constant-and-non-constant-time

Update-Note: BN_mod_exp_mont_consttime and BN_mod_exp_mont now require
inputs be fully reduced. I believe current callers tolerate this.

Additionally, due to a quirk of how certain operations were ordered,
using (publicly) zero exponent tolerated a NULL BN_CTX while other
exponents required non-NULL BN_CTX. Non-NULL BN_CTX is now required
uniformly. This is unlikely to cause problems. Any call site where the
exponent is always zero should just be replaced with BN_value_one().

Change-Id: I7c941953ea05f36dc2754facb9f4cf83a6789c61
Reviewed-on: https://boringssl-review.googlesource.com/27665
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
Reviewed-by: Steven Valdez <svaldez@google.com>
2018-04-24 18:29:29 +00:00
..
asn1 Avoid modifying stack in sk_find. 2018-04-12 21:02:12 +00:00
base64 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
bio Remove files from Trusty which can't link because of Trusty libc. 2018-04-19 19:06:58 +00:00
bn_extra Rename bn->top to bn->width. 2018-02-05 23:44:24 +00:00
buf Always process handshake records in full. 2017-10-17 14:53:11 +00:00
bytestring bytestring: document that |CBS_get_optional_asn1| can have a NULL output. 2018-03-19 20:22:25 +00:00
chacha Sync up some perlasm license headers and easy fixes. 2018-02-11 01:00:35 +00:00
cipher_extra Avoid some divisions in Lucky 13 fix. 2018-04-17 15:13:55 +00:00
cmac Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
conf Add more compatibility symbols for Node. 2017-11-03 01:31:50 +00:00
curve25519 Require that Ed25519 |s| values be < order. 2018-02-02 20:45:08 +00:00
dh Fx DH_set0_pqg. 2017-10-05 18:50:48 +00:00
digest_extra Export EVP_parse_digest_algorithm and add EVP_marshal_digest_algorithm. 2017-09-25 20:44:13 +00:00
dsa Remove DSA k+q kludge. 2018-02-06 00:51:54 +00:00
ec_extra Store EC_KEY's private key as an EC_SCALAR. 2018-03-07 21:17:31 +00:00
ecdh Store EC_KEY's private key as an EC_SCALAR. 2018-03-07 21:17:31 +00:00
ecdsa_extra Remove ECDSA_sign_setup and friends. 2017-11-22 20:23:40 +00:00
engine Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
err Check d is mostly-reduced in RSA_check_key. 2018-03-30 19:54:10 +00:00
evp Perform the RSA CRT reductions with Montgomery reduction. 2017-12-18 18:59:18 +00:00
fipsmodule Require BN_mod_exp_mont* inputs be reduced. 2018-04-24 18:29:29 +00:00
hkdf Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
hmac_extra Convert a number of tests to GTest. 2017-06-01 17:02:13 +00:00
lhash Unexport more of lhash. 2017-10-25 04:17:18 +00:00
obj Also add a decoupled OBJ_obj2txt. 2017-11-30 18:21:48 +00:00
pem Clear some _CRT_SECURE_NO_WARNINGS warnings. 2017-10-25 04:14:28 +00:00
perlasm Sync up some perlasm license headers and easy fixes. 2018-02-11 01:00:35 +00:00
pkcs7 Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
pkcs8 Export EVP_parse_digest_algorithm and add EVP_marshal_digest_algorithm. 2017-09-25 20:44:13 +00:00
poly1305 Remove custom memcpy and memset from poly1305_vec. 2017-11-10 20:53:30 +00:00
pool Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
rand_extra Remove CHROMIUM_ROLLING_MAGENTA_TO_ZIRCON scaffolding. 2017-09-18 21:34:32 +00:00
rc4 Simplify RC4 code and remove assembly. 2016-08-30 15:32:31 +00:00
rsa_extra Improve the RSA key generation failure probability. 2018-04-20 21:34:05 +00:00
stack Avoid modifying stack in sk_find. 2018-04-12 21:02:12 +00:00
test Support KAS tests for NIAP. 2018-01-16 22:57:01 +00:00
x509 Remove files from Trusty which can't link because of Trusty libc. 2018-04-19 19:06:58 +00:00
x509v3 Avoid modifying stack in sk_find. 2018-04-12 21:02:12 +00:00
CMakeLists.txt Add cpu-aarch64-fuchsia.c 2018-02-13 20:12:47 +00:00
compiler_test.cc Test that nullptr has the obvious memory representation. 2017-07-28 17:39:28 +00:00
constant_time_test.cc Add a test for CRYPTO_memcmp. 2018-03-27 16:22:47 +00:00
cpu-aarch64-fuchsia.c Add cpu-aarch64-fuchsia.c 2018-02-13 20:12:47 +00:00
cpu-aarch64-linux.c Add cpu-aarch64-fuchsia.c 2018-02-13 20:12:47 +00:00
cpu-arm-linux.c Add CRYPTO_needs_hwcap2_workaround. 2017-09-18 14:05:46 +00:00
cpu-arm.c Rewrite ARM feature detection. 2016-03-26 04:54:44 +00:00
cpu-intel.c Change OPENSSL_cpuid_setup to reserve more extended feature space. 2018-04-19 20:48:58 +00:00
cpu-ppc64le.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
crypto.c Add an OPENSSL_malloc_init stub. 2018-04-13 17:30:44 +00:00
ex_data.c Unexport more of lhash. 2017-10-25 04:17:18 +00:00
internal.h Move OPENSSL_FALLTHROUGH to internal headers. 2018-01-29 18:17:57 +00:00
mem.c Remove unused string.h include. 2018-04-24 17:42:39 +00:00
refcount_c11.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_lock.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
refcount_test.cc Convert various tests to GTest. 2017-05-23 22:34:09 +00:00
self_test.cc Extract FIPS KAT tests into a function. 2018-01-22 20:16:38 +00:00
thread_none.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_pthread.c Delete |pthread_key_t| on dlclose. 2018-02-20 19:53:24 +00:00
thread_test.cc Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread_win.c Run the comment converter on libcrypto. 2017-08-18 21:49:04 +00:00
thread.c Remove a bunch of unnecessary includes. 2016-06-28 20:31:14 +00:00