This commit addresses multiple side-channel vulnerabilities present during RSA key validation.
Private key parameters are re-computed using variable-time functions.
This issue was discovered and reported by the NISEC group at TAU Finland.
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9785)
+ /* Set consant-time flag on private parameters */
+ BN_set_flags(key->p, BN_FLG_CONSTTIME);
+ BN_set_flags(key->q, BN_FLG_CONSTTIME);
+ BN_set_flags(key->d, BN_FLG_CONSTTIME);
i = BN_new();
j = BN_new();
k = BN_new();
i = BN_new();
j = BN_new();
k = BN_new();
}
if (key->dmp1 != NULL && key->dmq1 != NULL && key->iqmp != NULL) {
}
if (key->dmp1 != NULL && key->dmq1 != NULL && key->iqmp != NULL) {
+ /* Set consant-time flag on CRT parameters */
+ BN_set_flags(key->dmp1, BN_FLG_CONSTTIME);
+ BN_set_flags(key->dmq1, BN_FLG_CONSTTIME);
+ BN_set_flags(key->iqmp, BN_FLG_CONSTTIME);
/* dmp1 = d mod (p-1)? */
if (!BN_sub(i, key->p, BN_value_one())) {
ret = -1;
/* dmp1 = d mod (p-1)? */
if (!BN_sub(i, key->p, BN_value_one())) {
ret = -1;