RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont both get called with...

Based on an original patch by Billy Brumley

CVE-2018-0737

Reviewed-by: Rich Salz <rsalz@openssl.org>

diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index d8ef3c7e6a1cc945adc21500f3f572c0f3c521dc..7f0a25648140c4e89d0497bdc5c105fd7002b6c2 100644 (file)
--- a/crypto/rsa/rsa_gen.c
+++ b/crypto/rsa/rsa_gen.c
@@ -157,6 +157,7 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,
             pinfo = sk_RSA_PRIME_INFO_value(prime_infos, i - 2);
             prime = pinfo->r;
         }
+        BN_set_flags(prime, BN_FLG_CONSTTIME);
 
         for (;;) {
  redo: