Bleichenbacher's DSA attack

diff --git a/CHANGES b/CHANGES
index a51cd20c8c927fb3fc59b6a0079a7a00999f769d..3e2d97daaab098559f85c670264601db691b8793 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,6 +3,10 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
+  *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
+     Bleichenbacher's DSA attack.
+     [Ulf Moeller]
+
   *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
      handle the new API. Currently only ECB, CBC modes supported. Add new
      AES OIDs. Add TLS AES ciphersuites as described in the "AES Ciphersuites

diff --git a/crypto/bn/bn.h b/crypto/bn/bn.h
index 47e355ea9d18f7e41a48b7e4871a5bdfd2609464..be4e7ae2ba3e372d28960694a3114fd73751887c 100644 (file)
--- a/crypto/bn/bn.h
+++ b/crypto/bn/bn.h
@@ -329,6 +329,7 @@ BIGNUM *BN_CTX_get(BN_CTX *ctx);
 void   BN_CTX_end(BN_CTX *ctx);
 int     BN_rand(BIGNUM *rnd, int bits, int top,int bottom);
 int     BN_pseudo_rand(BIGNUM *rnd, int bits, int top,int bottom);
+int    BN_rand_range(BIGNUM *rnd, BIGNUM *min, BIGNUM *max);
 int    BN_num_bits(const BIGNUM *a);
 int    BN_num_bits_word(BN_ULONG);
 BIGNUM *BN_new(void);

diff --git a/crypto/bn/bn_rand.c b/crypto/bn/bn_rand.c
index bab4510345090374089fd7d66d1313b88a29b6ed..f2c79b5e319f537ddcf3d205155ee8c5e4f43c67 100644 (file)
--- a/crypto/bn/bn_rand.c
+++ b/crypto/bn/bn_rand.c
@@ -168,3 +168,14 @@ int     BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
        return bnrand(2, rnd, bits, top, bottom);
        }
 #endif
+
+/* random number r: min <= r < max */
+int    BN_rand_range(BIGNUM *r, BIGNUM *min, BIGNUM *max)
+       {
+       int n = BN_num_bits(max);
+       do
+               {
+               if (!BN_rand(r, n, 0, 0)) return 0;
+               } while ((min && BN_cmp(r, min) < 0) || BN_cmp(r, max) >= 0);
+       return 1;
+       }

diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
index 4b600fa731dc44276ca4730428491fe47916bbd3..7304037947e5db01c0e80e66f7bf1efc75a44b5e 100644 (file)
--- a/crypto/dsa/dsa_ossl.c
+++ b/crypto/dsa/dsa_ossl.c
@@ -180,13 +180,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
        kinv=NULL;
 
        /* Get random k */
-       for (;;)
-               {
-               if (!BN_rand(&k, BN_num_bits(dsa->q), 0, 0)) goto err;
-               if (BN_cmp(&k,dsa->q) >= 0)
-                       BN_sub(&k,&k,dsa->q);
-               if (!BN_is_zero(&k)) break;
-               }
+       if (!BN_rand_range(&k, BN_value_one(), dsa->q)) goto err;
 
        if ((dsa->method_mont_p == NULL) && (dsa->flags & DSA_FLAG_CACHE_MONT_P))
                {

diff --git a/doc/crypto/BN_rand.pod b/doc/crypto/BN_rand.pod
index 33363c981f6099056a3cffd12d6e73ce4512111f..dc93949246bc44718bc6066e45ba087e8b4b2e71 100644 (file)
--- a/doc/crypto/BN_rand.pod
+++ b/doc/crypto/BN_rand.pod
@@ -12,6 +12,8 @@ BN_rand, BN_pseudo_rand - generate pseudo-random number
 
  int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom);
 
+ int BN_rand_range(BIGNUM *rnd, BIGNUM *min, BIGNUM *max);
+
 =head1 DESCRIPTION
 
 BN_rand() generates a cryptographically strong pseudo-random number of
@@ -25,11 +27,15 @@ this function are not necessarily unpredictable. They can be used for
 non-cryptographic purposes and for certain purposes in cryptographic
 protocols, but usually not for key generation etc.
 
-The PRNG must be seeded prior to calling BN_rand().
+BN_rand_range() generates a cryptographically strong pseudo-random
+number B<rnd> in the range B<min> E<lt>= B<rnd> E<lt> B<max>. B<min>
+may be NULL, in that case 0 E<lt>= B<rnd> E<lt> B<max>.
+
+The PRNG must be seeded prior to calling BN_rand() or BN_rand_range().
 
 =head1 RETURN VALUES
 
-BN_rand() and BN_pseudo_rand() return 1 on success, 0 on error.
+The functions return 1 on success, 0 on error.
 The error codes can be obtained by L<ERR_get_error(3)|ERR_get_error(3)>.
 
 =head1 SEE ALSO
@@ -40,6 +46,7 @@ L<RAND_add(3)|RAND_add(3)>, L<RAND_bytes(3)|RAND_bytes(3)>
 =head1 HISTORY
 
 BN_rand() is available in all versions of SSLeay and OpenSSL.
-BN_pseudo_rand() was added in OpenSSL 0.9.5.
+BN_pseudo_rand() was added in OpenSSL 0.9.5, and BN_rand_range()
+in OpenSSL 0.9.6a.
 
 =cut

diff --git a/doc/crypto/bn.pod b/doc/crypto/bn.pod
index 224dfe166a7079144ce02edb3eceb839dcc1a369..8558ccfcd5c6a0ce045dc8a64f399901b59c1761 100644 (file)
--- a/doc/crypto/bn.pod
+++ b/doc/crypto/bn.pod
@@ -68,6 +68,7 @@ bn - multiprecision integer arithmetics
 
  int BN_rand(BIGNUM *rnd, int bits, int top, int bottom);
  int BN_pseudo_rand(BIGNUM *rnd, int bits, int top, int bottom);
+ int BN_rand_range(BIGNUM *rnd, BIGNUM *min, BIGNUM *max);
 
  BIGNUM *BN_generate_prime(BIGNUM *ret, int bits,int safe, BIGNUM *add,
          BIGNUM *rem, void (*callback)(int, int, void *), void *cb_arg);