make sure DSA signing exponentiations really are constant-time

[openssl.git] / crypto / dsa / dsa_ossl.c

diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
index 033bf9017f70297db575521a30c7268262cc2782..3fd8a35613d32dce4d252a6c65986df615210fe7 100644 (file)
--- a/crypto/dsa/dsa_ossl.c
+++ b/crypto/dsa/dsa_ossl.c
@@ -202,7 +202,7 @@ err:
 static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
        {
        BN_CTX *ctx;
-       BIGNUM k,*kinv=NULL,*r=NULL;
+       BIGNUM k,kq,*K,*kinv=NULL,*r=NULL;
        int ret=0;
 
        if (!dsa->p || !dsa->q || !dsa->g)
@@ -212,6 +212,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
                }
 
        BN_init(&k);
+       BN_init(&kq);
 
        if (ctx_in == NULL)
                {
@@ -221,23 +222,50 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
                ctx=ctx_in;
 
        if ((r=BN_new()) == NULL) goto err;
-       kinv=NULL;
 
        /* Get random k */
        do
                if (!BN_rand_range(&k, dsa->q)) goto err;
        while (BN_is_zero(&k));
+       if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0)
+               {
+               BN_set_flags(&k, BN_FLG_EXP_CONSTTIME);
+               }
 
-       if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
+       if (dsa->flags & DSA_FLAG_CACHE_MONT_P)
                {
-               if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                       if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
-                               dsa->p,ctx)) goto err;
+               if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p,
+                                               CRYPTO_LOCK_DSA,
+                                               dsa->p, ctx))
+                       goto err;
                }
 
        /* Compute r = (g^k mod p) mod q */
-       DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, &k, dsa->p, ctx,
-                       (BN_MONT_CTX *)dsa->method_mont_p);
+
+       if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0)
+               {
+               if (!BN_copy(&kq, &k)) goto err;
+
+               /* We do not want timing information to leak the length of k,
+                * so we compute g^k using an equivalent exponent of fixed length.
+                *
+                * (This is a kludge that we need because the BN_mod_exp_mont()
+                * does not let us specify the desired timing behaviour.) */
+
+               if (!BN_add(&kq, &kq, dsa->q)) goto err;
+               if (BN_num_bits(&kq) <= BN_num_bits(dsa->q))
+                       {
+                       if (!BN_add(&kq, &kq, dsa->q)) goto err;
+                       }
+
+               K = &kq;
+               }
+       else
+               {
+               K = &k;
+               }
+       DSA_BN_MOD_EXP(goto err, dsa, r, dsa->g, K, dsa->p, ctx,
+                       dsa->method_mont_p);
        if (!BN_mod(r,r,dsa->q,ctx)) goto err;
 
        /* Compute  part of 's = inv(k) (m + xr) mod q' */
@@ -259,6 +287,7 @@ err:
        if (ctx_in == NULL) BN_CTX_free(ctx);
        if (kinv != NULL) BN_clear_free(kinv);
        BN_clear_free(&k);
+       BN_clear_free(&kq);
        return(ret);
        }
 
@@ -307,13 +336,14 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
        /* u2 = r * w mod q */
        if (!BN_mod_mul(&u2,sig->r,&u2,dsa->q,ctx)) goto err;
 
-       if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
+
+       if (dsa->flags & DSA_FLAG_CACHE_MONT_P)
                {
-               if ((dsa->method_mont_p=(char *)BN_MONT_CTX_new()) != NULL)
-                       if (!BN_MONT_CTX_set((BN_MONT_CTX *)dsa->method_mont_p,
-                               dsa->p,ctx)) goto err;
+               mont = BN_MONT_CTX_set_locked(&dsa->method_mont_p,
+                                       CRYPTO_LOCK_DSA, dsa->p, ctx);
+               if (!mont)
+                       goto err;
                }
-       mont=(BN_MONT_CTX *)dsa->method_mont_p;
 
 
        DSA_MOD_EXP(goto err, dsa, &t1, dsa->g, &u1, dsa->pub_key, &u2, dsa->p, ctx, mont);
@@ -326,7 +356,7 @@ static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
        ret=(BN_ucmp(&u1, sig->r) == 0);
 
        err:
-       /* XXX: surely this is wrong - if ret is 0, it just didn't verify
+       /* XXX: surely this is wrong - if ret is 0, it just didn't verify;
           there is no error in BN. Test should be ret == -1 (Ben) */
        if (ret != 1) DSAerr(DSA_F_DSA_DO_VERIFY,ERR_R_BN_LIB);
        if (ctx != NULL) BN_CTX_free(ctx);
@@ -345,7 +375,7 @@ static int dsa_init(DSA *dsa)
 static int dsa_finish(DSA *dsa)
 {
        if(dsa->method_mont_p)
-               BN_MONT_CTX_free((BN_MONT_CTX *)dsa->method_mont_p);
+               BN_MONT_CTX_free(dsa->method_mont_p);
        return(1);
 }