Fix for CVE-2014-0076

[openssl.git] / crypto / ec / ec2_mult.c

diff --git a/crypto/ec/ec2_mult.c b/crypto/ec/ec2_mult.c
index f41665ac10bcbb8bc3065710506f7c97ed7a7854..06405d0716fff0c4d5c82af2b4f6967f0d87badf 100644 (file)
--- a/crypto/ec/ec2_mult.c
+++ b/crypto/ec/ec2_mult.c
@@ -210,11 +210,15 @@ static int gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIG
        return ret;
        }
 
+
 /* Computes scalar*point and stores the result in r.
  * point can not equal r.
- * Uses algorithm 2P of
+ * Uses a modified algorithm 2P of
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
  *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
+ *
+ * To protect against side-channel attack the function uses constant time swap,
+ * avoiding conditional branches.
  */
 static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
        const EC_POINT *point, BN_CTX *ctx)
@@ -248,6 +252,11 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
        x2 = &r->X;
        z2 = &r->Y;
 
+       bn_wexpand(x1, group->field.top);
+       bn_wexpand(z1, group->field.top);
+       bn_wexpand(x2, group->field.top);
+       bn_wexpand(z2, group->field.top);
+
        if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
        if (!BN_one(z1)) goto err; /* z1 = 1 */
        if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
@@ -272,16 +281,12 @@ static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r,
                word = scalar->d[i];
                while (mask)
                        {
-                       if (word & mask)
-                               {
-                               if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
-                               if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
-                               }
-                       else
-                               {
-                               if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
-                               if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
-                               }
+                       BN_consttime_swap(word & mask, x1, x2, group->field.top);
+                       BN_consttime_swap(word & mask, z1, z2, group->field.top);
+                       if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
+                       if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
+                       BN_consttime_swap(word & mask, x1, x2, group->field.top);
+                       BN_consttime_swap(word & mask, z1, z2, group->field.top);
                        mask >>= 1;
                        }
                mask = BN_TBIT;