122 lines
4.9 KiB
Diff
122 lines
4.9 KiB
Diff
From ccdf50988462e9889f3553cbefbe81bba3e41e1f Mon Sep 17 00:00:00 2001
|
|
From: hy <12444214+dhjgty@user.noreply.gitee.com>
|
|
Date: Tue, 25 Feb 2025 23:29:26 +0800
|
|
Subject: [PATCH] Fix timing side-channel in ECDSA signature computation
|
|
There is a timing signal of around 300 nanoseconds when the top word of
|
|
the inverted ECDSA nonce value is zero. This can happen with significant
|
|
probability only for some of the supported elliptic curves. In particular
|
|
the NIST P-521 curve is affected. To be able to measure this leak, the
|
|
attacker process must either be located in the same physical computer or
|
|
must have a very fast network connection with low latency.
|
|
|
|
Attacks on ECDSA nonce are also known as Minerva attack.
|
|
|
|
Fixes CVE-2024-13176
|
|
|
|
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
|
Reviewed-by: Neil Horman <nhorman@openssl.org>
|
|
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
|
|
|
|
---
|
|
.../OpensslLib/openssl/crypto/bn/bn_exp.c | 21 +++++++++++++------
|
|
.../OpensslLib/openssl/crypto/ec/ec_lib.c | 7 ++++---
|
|
.../OpensslLib/openssl/include/crypto/bn.h | 3 +++
|
|
3 files changed, 22 insertions(+), 9 deletions(-)
|
|
|
|
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c
|
|
index 4e169ae1..a161e580 100644
|
|
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c
|
|
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c
|
|
@@ -598,7 +598,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
|
|
* out by Colin Percival,
|
|
* http://www.daemonology.net/hyperthreading-considered-harmful/)
|
|
*/
|
|
-int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
+int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
const BIGNUM *m, BN_CTX *ctx,
|
|
BN_MONT_CTX *in_mont)
|
|
{
|
|
@@ -615,10 +615,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
unsigned int t4 = 0;
|
|
#endif
|
|
|
|
- bn_check_top(a);
|
|
- bn_check_top(p);
|
|
- bn_check_top(m);
|
|
-
|
|
if (!BN_is_odd(m)) {
|
|
ERR_raise(ERR_LIB_BN, BN_R_CALLED_WITH_EVEN_MODULUS);
|
|
return 0;
|
|
@@ -1138,7 +1134,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
goto err;
|
|
} else
|
|
#endif
|
|
- if (!BN_from_montgomery(rr, &tmp, mont, ctx))
|
|
+ if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx))
|
|
goto err;
|
|
ret = 1;
|
|
err:
|
|
@@ -1152,6 +1148,19 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
return ret;
|
|
}
|
|
|
|
+int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
+ const BIGNUM *m, BN_CTX *ctx,
|
|
+ BN_MONT_CTX *in_mont)
|
|
+{
|
|
+ bn_check_top(a);
|
|
+ bn_check_top(p);
|
|
+ bn_check_top(m);
|
|
+ if (!bn_mod_exp_mont_fixed_top(rr, a, p, m, ctx, in_mont))
|
|
+ return 0;
|
|
+ bn_correct_top(rr);
|
|
+ return 1;
|
|
+}
|
|
+
|
|
int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
|
|
const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
|
|
{
|
|
diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c
|
|
index b1696d93..1f0bf1ec 100644
|
|
--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c
|
|
+++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c
|
|
@@ -20,6 +20,7 @@
|
|
#include <openssl/err.h>
|
|
#include <openssl/opensslv.h>
|
|
#include "crypto/ec.h"
|
|
+#include "crypto/bn.h"
|
|
#include "internal/nelem.h"
|
|
#include "ec_local.h"
|
|
|
|
@@ -1262,10 +1263,10 @@ static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
|
|
if (!BN_sub(e, group->order, e))
|
|
goto err;
|
|
/*-
|
|
- * Exponent e is public.
|
|
- * No need for scatter-gather or BN_FLG_CONSTTIME.
|
|
+ * Although the exponent is public we want the result to be
|
|
+ * fixed top.
|
|
*/
|
|
- if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data))
|
|
+ if (!bn_mod_exp_mont_fixed_top(r, x, e, group->order, ctx, group->mont_data))
|
|
goto err;
|
|
|
|
ret = 1;
|
|
diff --git a/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h b/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h
|
|
index fd1c09d9..ba50bca2 100644
|
|
--- a/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h
|
|
+++ b/CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h
|
|
@@ -73,6 +73,9 @@ int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words);
|
|
*/
|
|
int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
|
|
BN_MONT_CTX *mont, BN_CTX *ctx);
|
|
+int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
|
|
+ const BIGNUM *m, BN_CTX *ctx,
|
|
+ BN_MONT_CTX *in_mont);
|
|
int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
|
|
BN_CTX *ctx);
|
|
int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
|
|
--
|
|
2.33.0
|
|
|