1. 28 5月, 2019 2 次提交
  2. 21 5月, 2019 1 次提交
  3. 26 2月, 2019 2 次提交
  4. 21 2月, 2019 1 次提交
    • B
      SCA hardening for mod. field inversion in EC_GROUP · 48e82c8e
      Billy Brumley 提交于
      This commit adds a dedicated function in `EC_METHOD` to access a modular
      field inversion implementation suitable for the specifics of the
      implemented curve, featuring SCA countermeasures.
      
      The new pointer is defined as:
      `int (*field_inv)(const EC_GROUP*, BIGNUM *r, const BIGNUM *a, BN_CTX*)`
      and computes the multiplicative inverse of `a` in the underlying field,
      storing the result in `r`.
      
      Three implementations are included, each including specific SCA
      countermeasures:
        - `ec_GFp_simple_field_inv()`, featuring SCA hardening through
          blinding.
        - `ec_GFp_mont_field_inv()`, featuring SCA hardening through Fermat's
          Little Theorem (FLT) inversion.
        - `ec_GF2m_simple_field_inv()`, that uses `BN_GF2m_mod_inv()` which
          already features SCA hardening through blinding.
      
      From a security point of view, this also helps addressing a leakage
      previously affecting conversions from projective to affine coordinates.
      
      This commit also adds a new error reason code (i.e.,
      `EC_R_CANNOT_INVERT`) to improve consistency between the three
      implementations as all of them could fail for the same reason but
      through different code paths resulting in inconsistent error stack
      states.
      Co-authored-by: NNicola Tuveri <nic.tuv@gmail.com>
      
      (cherry picked from commit e0033efc30b0f00476bba8f0fa5512be5dc8a3f1)
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/8262)
      48e82c8e
  5. 15 2月, 2019 1 次提交
    • M
      Don't signal SSL_CB_HANDSHAKE_START for TLSv1.3 post-handshake messages · 37857e9b
      Matt Caswell 提交于
      The original 1.1.1 design was to use SSL_CB_HANDSHAKE_START and
      SSL_CB_HANDSHAKE_DONE to signal start/end of a post-handshake message
      exchange in TLSv1.3. Unfortunately experience has shown that this confuses
      some applications who mistake it for a TLSv1.2 renegotiation. This means
      that KeyUpdate messages are not handled properly.
      
      This commit removes the use of SSL_CB_HANDSHAKE_START and
      SSL_CB_HANDSHAKE_DONE to signal the start/end of a post-handshake
      message exchange. Individual post-handshake messages are still signalled in
      the normal way.
      
      This is a potentially breaking change if there are any applications already
      written that expect to see these TLSv1.3 events. However, without it,
      KeyUpdate is not currently usable for many applications.
      
      Fixes #8069
      Reviewed-by: NRichard Levitte <levitte@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/8096)
      
      (cherry picked from commit 4af5836b55442f31795eff6c8c81ea7a1b8cf94b)
      37857e9b
  6. 02 2月, 2019 1 次提交
  7. 01 2月, 2019 1 次提交
  8. 07 12月, 2018 1 次提交
  9. 25 11月, 2018 1 次提交
  10. 20 11月, 2018 3 次提交
  11. 17 10月, 2018 2 次提交
    • A
      EVP module documentation pass · 87103969
      Antoine Salon 提交于
      Replace ECDH_KDF_X9_62() with internal ecdh_KDF_X9_63()
      Signed-off-by: NAntoine Salon <asalon@vmware.com>
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      Reviewed-by: NNicola Tuveri <nic.tuv@gmail.com>
      (Merged from https://github.com/openssl/openssl/pull/7345)
      
      (cherry picked from commit ffd89124bdfc9e69349492c3f15383bb35520a11)
      87103969
    • D
      DRBG: fix reseeding via RAND_add()/RAND_seed() with large input · dbf0a496
      Dr. Matthias St. Pierre 提交于
      In pull request #4328 the seeding of the DRBG via RAND_add()/RAND_seed()
      was implemented by buffering the data in a random pool where it is
      picked up later by the rand_drbg_get_entropy() callback. This buffer
      was limited to the size of 4096 bytes.
      
      When a larger input was added via RAND_add() or RAND_seed() to the DRBG,
      the reseeding failed, but the error returned by the DRBG was ignored
      by the two calling functions, which both don't return an error code.
      As a consequence, the data provided by the application was effectively
      ignored.
      
      This commit fixes the problem by a more efficient implementation which
      does not copy the data in memory and by raising the buffer the size limit
      to INT32_MAX (2 gigabytes). This is less than the NIST limit of 2^35 bits
      but it was chosen intentionally to avoid platform dependent problems
      like integer sizes and/or signed/unsigned conversion.
      
      Additionally, the DRBG is now less permissive on errors: In addition to
      pushing a message to the openssl error stack, it enters the error state,
      which forces a reinstantiation on next call.
      
      Thanks go to Dr. Falko Strenzke for reporting this issue to the
      openssl-security mailing list. After internal discussion the issue
      has been categorized as not being security relevant, because the DRBG
      reseeds automatically and is fully functional even without additional
      randomness provided by the application.
      
      Fixes #7381
      Reviewed-by: NPaul Dale <paul.dale@oracle.com>
      (Merged from https://github.com/openssl/openssl/pull/7382)
      
      (cherry picked from commit 3064b55134434a0b2850f07eff57120f35bb269a)
      dbf0a496
  12. 11 9月, 2018 3 次提交
  13. 10 9月, 2018 1 次提交
  14. 21 8月, 2018 1 次提交
  15. 15 8月, 2018 1 次提交
  16. 14 8月, 2018 1 次提交
  17. 07 8月, 2018 2 次提交
  18. 27 7月, 2018 1 次提交
  19. 26 7月, 2018 2 次提交
  20. 24 7月, 2018 1 次提交
  21. 18 7月, 2018 1 次提交
  22. 16 7月, 2018 2 次提交
    • N
      EC2M Lopez-Dahab ladder implementation · f45846f5
      Nicola Tuveri 提交于
      This commit uses the new ladder scaffold to implement a specialized
      ladder step based on differential addition-and-doubling in mixed
      Lopez-Dahab projective coordinates, modified to independently blind the
      operands.
      
      The arithmetic in `ladder_pre`, `ladder_step` and `ladder_post` is
      auto generated with tooling:
      - see, e.g., "Guide to ECC" Alg 3.40 for reference about the
        `ladder_pre` implementation;
      - see https://www.hyperelliptic.org/EFD/g12o/auto-code/shortw/xz/ladder/mladd-2003-s.op3
        for the differential addition-and-doubling formulas implemented in
        `ladder_step`;
      - see, e.g., "Fast Multiplication on Elliptic Curves over GF(2**m)
        without Precomputation" (Lopez and Dahab, CHES 1999) Appendix Alg Mxy
        for the `ladder_post` implementation to recover the `(x,y)` result in
        affine coordinates.
      Co-authored-by: NBilly Brumley <bbrumley@gmail.com>
      Co-authored-by: NSohaib ul Hassan <soh.19.hassan@gmail.com>
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/6690)
      f45846f5
    • N
      EC point multiplication: add `ladder` scaffold · 37124360
      Nicola Tuveri 提交于
      for specialized Montgomery ladder implementations
      
      PR #6009 and #6070 replaced the default EC point multiplication path for
      prime and binary curves with a unified Montgomery ladder implementation
      with various timing attack defenses (for the common paths when a secret
      scalar is feed to the point multiplication).
      The newly introduced default implementation directly used
      EC_POINT_add/dbl in the main loop.
      
      The scaffolding introduced by this commit allows EC_METHODs to define a
      specialized `ladder_step` function to improve performances by taking
      advantage of efficient formulas for differential addition-and-doubling
      and different coordinate systems.
      
      - `ladder_pre` is executed before the main loop of the ladder: by
        default it copies the input point P into S, and doubles it into R.
        Specialized implementations could, e.g., use this hook to transition
        to different coordinate systems before copying and doubling;
      - `ladder_step` is the core of the Montgomery ladder loop: by default it
        computes `S := R+S; R := 2R;`, but specific implementations could,
        e.g., implement a more efficient formula for differential
        addition-and-doubling;
      - `ladder_post` is executed after the Montgomery ladder loop: by default
        it's a noop, but specialized implementations could, e.g., use this
        hook to transition back from the coordinate system used for optimizing
        the differential addition-and-doubling or recover the y coordinate of
        the result point.
      
      This commit also renames `ec_mul_consttime` to `ec_scalar_mul_ladder`,
      as it better corresponds to what this function does: nothing can be
      truly said about the constant-timeness of the overall execution of this
      function, given that the underlying operations are not necessarily
      constant-time themselves.
      What this implementation ensures is that the same fixed sequence of
      operations is executed for each scalar multiplication (for a given
      EC_GROUP), with no dependency on the value of the input scalar.
      Co-authored-by: NSohaib ul Hassan <soh.19.hassan@gmail.com>
      Co-authored-by: NBilly Brumley <bbrumley@gmail.com>
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/6690)
      37124360
  23. 09 7月, 2018 1 次提交
  24. 27 6月, 2018 1 次提交
  25. 22 6月, 2018 3 次提交
  26. 21 6月, 2018 1 次提交
    • M
      Add blinding to a DSA signature · 7f9822a4
      Matt Caswell 提交于
      This extends the recently added ECDSA signature blinding to blind DSA too.
      
      This is based on side channel attacks demonstrated by Keegan Ryan (NCC
      Group) for ECDSA which are likely to be able to be applied to DSA.
      
      Normally, as in ECDSA, during signing the signer calculates:
      
      s:= k^-1 * (m + r * priv_key) mod order
      
      In ECDSA, the addition operation above provides a sufficient signal for a
      flush+reload attack to derive the private key given sufficient signature
      operations.
      
      As a mitigation (based on a suggestion from Keegan) we add blinding to
      the operation so that:
      
      s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order
      
      Since this attack is a localhost side channel only no CVE is assigned.
      
      This commit also tweaks the previous ECDSA blinding so that blinding is
      only removed at the last possible step.
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/6522)
      7f9822a4
  27. 19 6月, 2018 1 次提交
    • S
      Implement coordinate blinding for EC_POINT · f667820c
      Sohaib ul Hassan 提交于
      This commit implements coordinate blinding, i.e., it randomizes the
      representative of an elliptic curve point in its equivalence class, for
      prime curves implemented through EC_GFp_simple_method,
      EC_GFp_mont_method, and EC_GFp_nist_method.
      
      This commit is derived from the patch
      https://marc.info/?l=openssl-dev&m=131194808413635 by Billy Brumley.
      
      Coordinate blinding is a generally useful side-channel countermeasure
      and is (mostly) free. The function itself takes a few field
      multiplicationss, but is usually only necessary at the beginning of a
      scalar multiplication (as implemented in the patch). When used this way,
      it makes the values that variables take (i.e., field elements in an
      algorithm state) unpredictable.
      
      For instance, this mitigates chosen EC point side-channel attacks for
      settings such as ECDH and EC private key decryption, for the
      aforementioned curves.
      
      For EC_METHODs using different coordinate representations this commit
      does nothing, but the corresponding coordinate blinding function can be
      easily added in the future to extend these changes to such curves.
      Co-authored-by: NNicola Tuveri <nic.tuv@gmail.com>
      Co-authored-by: NBilly Brumley <bbrumley@gmail.com>
      Reviewed-by: NAndy Polyakov <appro@openssl.org>
      Reviewed-by: NMatt Caswell <matt@openssl.org>
      (Merged from https://github.com/openssl/openssl/pull/6501)
      f667820c
  28. 13 6月, 2018 1 次提交
    • M
      Add blinding to an ECDSA signature · a3e9d5aa
      Matt Caswell 提交于
      Keegan Ryan (NCC Group) has demonstrated a side channel attack on an
      ECDSA signature operation. During signing the signer calculates:
      
      s:= k^-1 * (m + r * priv_key) mod order
      
      The addition operation above provides a sufficient signal for a
      flush+reload attack to derive the private key given sufficient signature
      operations.
      
      As a mitigation (based on a suggestion from Keegan) we add blinding to
      the operation so that:
      
      s := k^-1 * blind^-1 (blind * m + blind * r * priv_key) mod order
      
      Since this attack is a localhost side channel only no CVE is assigned.
      Reviewed-by: NRich Salz <rsalz@openssl.org>
      a3e9d5aa