From: Bodo Möller <bodo@openssl.org>
Date: Fri, 16 Nov 2007 13:01:14 +0000 (+0000)
Subject: The hash length check wasn't strict enough,
X-Git-Tag: OpenSSL_0_9_8k^2~629
X-Git-Url: https://git.openssl.org/?p=openssl.git;a=commitdiff_plain;h=da989402f22d44bab2e920ec4872e711991e0047;ds=sidebyside

The hash length check wasn't strict enough,
as pointed out by Ernst G Giessmann
---

diff --git a/crypto/ecdsa/ecs_ossl.c b/crypto/ecdsa/ecs_ossl.c
index 32d66a9774..f8b5d4ed6a 100644
--- a/crypto/ecdsa/ecs_ossl.c
+++ b/crypto/ecdsa/ecs_ossl.c
@@ -251,8 +251,16 @@ static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dgst_len,
 		ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_EC_LIB);
 		goto err;
 	}
-	if (dgst_len > BN_num_bytes(order))
+	if (8 * dgst_len > BN_num_bits(order))
 	{
+		/* XXX
+		 * 
+		 * Should provide for optional hash truncation:
+		 * Keep the BN_num_bits(order) leftmost bits of dgst
+		 * (see March 2006 FIPS 186-3 draft, which has a few
+		 * confusing errors in this part though)
+		 */
+
 		ECDSAerr(ECDSA_F_ECDSA_DO_SIGN,
 			ECDSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
 		goto err;