Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP2:GA
libnettle.9764
libnettle-CVE-2018-16869-3.4.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libnettle-CVE-2018-16869-3.4.patch of Package libnettle.9764
diff -Naur nettle-3.4/aes-set-encrypt-key.c nettle-3.4.1/aes-set-encrypt-key.c --- nettle-3.4/aes-set-encrypt-key.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/aes-set-encrypt-key.c 2018-12-04 21:56:05.000000000 +0100 @@ -37,6 +37,7 @@ #endif #include <assert.h> +#include <stdlib.h> #include "aes-internal.h" diff -Naur nettle-3.4/cnd-memcpy.c nettle-3.4.1/cnd-memcpy.c --- nettle-3.4/cnd-memcpy.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/cnd-memcpy.c 2018-12-04 21:56:05.000000000 +0100 @@ -0,0 +1,55 @@ +/* cnd-memcpy.c + + Copyright (C) 2018 Niels Möller + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "memops.h" + +void +cnd_memcpy(int cnd, volatile void *dst, const volatile void *src, size_t n) +{ + const volatile unsigned char *sp = src; + volatile unsigned char *dp = dst; + volatile unsigned char c; + volatile unsigned char m; + size_t i; + + m = -(unsigned char) cnd; + + for (i = 0; i < n; i++) + { + c = (sp[i] & m); + c |= (dp[i] & ~m); + dp[i] = c; + } +} diff -Naur nettle-3.4/configure.ac nettle-3.4.1/configure.ac --- nettle-3.4/configure.ac 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/configure.ac 2018-12-04 21:56:06.000000000 +0100 @@ -236,9 +236,9 @@ # Checks for libraries if test "x$enable_public_key" = "xyes" ; then if test "x$enable_mini_gmp" = "xno" ; then - AC_CHECK_LIB(gmp, __gmpz_powm_sec,, + AC_CHECK_LIB(gmp, __gmpn_sec_div_r,, [AC_MSG_WARN( - [GNU MP not found, or too old. GMP-5.0 or later is needed, see http://gmplib.org/. + [GNU MP not found, or too old. GMP-6.0 or later is needed, see https://gmplib.org/. Support for public key algorithms will be unavailable.])] enable_public_key=no) diff -Naur nettle-3.4/des-compat.c nettle-3.4.1/des-compat.c --- nettle-3.4/des-compat.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/des-compat.c 2018-12-04 21:56:05.000000000 +0100 @@ -35,6 +35,7 @@ # include "config.h" #endif +#include <stdlib.h> #include <string.h> #include <assert.h> @@ -48,7 +49,7 @@ static void des_compat_des3_encrypt(struct des_compat_des3 *ctx, - uint32_t length, uint8_t *dst, const uint8_t *src) + size_t length, uint8_t *dst, const uint8_t *src) { nettle_des_encrypt(ctx->keys[0], length, dst, src); nettle_des_decrypt(ctx->keys[1], length, dst, dst); @@ -57,7 +58,7 @@ static void des_compat_des3_decrypt(struct des_compat_des3 *ctx, - uint32_t length, uint8_t *dst, const uint8_t *src) + size_t length, uint8_t *dst, const uint8_t *src) { nettle_des_decrypt(ctx->keys[2], length, dst, src); nettle_des_encrypt(ctx->keys[1], length, dst, dst); diff -Naur nettle-3.4/gmp-glue.c nettle-3.4.1/gmp-glue.c --- nettle-3.4/gmp-glue.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/gmp-glue.c 2018-12-04 21:56:06.000000000 +0100 @@ -247,6 +247,37 @@ } void +mpn_get_base256 (uint8_t *rp, size_t rn, + const mp_limb_t *xp, mp_size_t xn) +{ + unsigned bits; + mp_limb_t in; + for (bits = in = 0; xn > 0 && rn > 0; ) + { + if (bits >= 8) + { + rp[--rn] = in; + in >>= 8; + bits -= 8; + } + else + { + uint8_t old = in; + in = *xp++; + xn--; + rp[--rn] = old | (in << bits); + in >>= (8 - bits); + bits += GMP_NUMB_BITS - 8; + } + } + while (rn > 0) + { + rp[--rn] = in; + in >>= 8; + } +} + +void mpn_get_base256_le (uint8_t *rp, size_t rn, const mp_limb_t *xp, mp_size_t xn) { diff -Naur nettle-3.4/gmp-glue.h nettle-3.4.1/gmp-glue.h --- nettle-3.4/gmp-glue.h 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/gmp-glue.h 2018-12-04 21:56:06.000000000 +0100 @@ -57,6 +57,7 @@ #define mpz_set_n _nettle_mpz_set_n #define mpn_set_base256 _nettle_mpn_set_base256 #define mpn_set_base256_le _nettle_mpn_set_base256_le +#define mpn_get_base256 _nettle_mpn_get_base256 #define mpn_get_base256_le _nettle_mpn_get_base256_le #define gmp_alloc_limbs _nettle_gmp_alloc_limbs #define gmp_free_limbs _nettle_gmp_free_limbs @@ -81,6 +82,9 @@ # define cnd_sub_n(cnd, rp, ap, n) mpn_submul_1 ((rp), (ap), (n), (cnd) != 0) #endif +#define NETTLE_OCTET_SIZE_TO_LIMB_SIZE(n) \ + (((n) * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS) + /* Some functions for interfacing between mpz and mpn code. Signs of the mpz numbers are generally ignored. */ @@ -148,6 +152,10 @@ const uint8_t *xp, size_t xn); void +mpn_get_base256 (uint8_t *rp, size_t rn, + const mp_limb_t *xp, mp_size_t xn); + +void mpn_get_base256_le (uint8_t *rp, size_t rn, const mp_limb_t *xp, mp_size_t xn); diff -Naur nettle-3.4/Makefile.in nettle-3.4.1/Makefile.in --- nettle-3.4/Makefile.in 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/Makefile.in 2018-12-04 21:56:06.000000000 +0100 @@ -92,6 +92,7 @@ camellia256-meta.c \ cast128.c cast128-meta.c cbc.c \ ccm.c ccm-aes128.c ccm-aes192.c ccm-aes256.c cfb.c \ + cnd-memcpy.c \ chacha-crypt.c chacha-core-internal.c \ chacha-poly1305.c chacha-poly1305-meta.c \ chacha-set-key.c chacha-set-nonce.c \ @@ -143,10 +144,12 @@ bignum.c bignum-random.c bignum-random-prime.c \ sexp2bignum.c \ pkcs1.c pkcs1-encrypt.c pkcs1-decrypt.c \ + pkcs1-sec-decrypt.c \ pkcs1-rsa-digest.c pkcs1-rsa-md5.c pkcs1-rsa-sha1.c \ pkcs1-rsa-sha256.c pkcs1-rsa-sha512.c \ pss.c pss-mgf1.c \ rsa.c rsa-sign.c rsa-sign-tr.c rsa-verify.c \ + rsa-sec-compute-root.c \ rsa-pkcs1-sign.c rsa-pkcs1-sign-tr.c rsa-pkcs1-verify.c \ rsa-md5-sign.c rsa-md5-sign-tr.c rsa-md5-verify.c \ rsa-sha1-sign.c rsa-sha1-sign-tr.c rsa-sha1-verify.c \ @@ -154,7 +157,8 @@ rsa-sha512-sign.c rsa-sha512-sign-tr.c rsa-sha512-verify.c \ rsa-pss-sha256-sign-tr.c rsa-pss-sha256-verify.c \ rsa-pss-sha512-sign-tr.c rsa-pss-sha512-verify.c \ - rsa-encrypt.c rsa-decrypt.c rsa-decrypt-tr.c \ + rsa-encrypt.c rsa-decrypt.c \ + rsa-sec-decrypt.c rsa-decrypt-tr.c \ rsa-keygen.c rsa-blind.c \ rsa2sexp.c sexp2rsa.c \ dsa.c dsa-compat.c dsa-compat-keygen.c dsa-gen-params.c \ @@ -228,6 +232,7 @@ aes-internal.h camellia-internal.h serpent-internal.h \ cast128_sboxes.h desinfo.h desCode.h \ memxor-internal.h nettle-internal.h nettle-write.h \ + rsa-internal.h \ gmp-glue.h ecc-internal.h fat-setup.h \ mini-gmp.h asm.m4 \ nettle.texinfo nettle.info nettle.html nettle.pdf sha-example.c diff -Naur nettle-3.4/memops.h nettle-3.4.1/memops.h --- nettle-3.4/memops.h 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/memops.h 2018-12-04 21:56:06.000000000 +0100 @@ -39,11 +39,17 @@ #endif /* Name mangling */ +#define cnd_memcpy nettle_cnd_memcpy #define memeql_sec nettle_memeql_sec int memeql_sec (const void *a, const void *b, size_t n); +/* Side-channel silent conditional memcpy. cnd must be 0 (nop) or 1 + (copy). */ +void +cnd_memcpy(int cnd, volatile void *dst, const volatile void *src, size_t n); + #ifdef __cplusplus } #endif diff -Naur nettle-3.4/nettle-internal.c nettle-3.4.1/nettle-internal.c diff -Naur nettle-3.4/pkcs1-decrypt.c nettle-3.4.1/pkcs1-decrypt.c --- nettle-3.4/pkcs1-decrypt.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/pkcs1-decrypt.c 2018-12-04 21:56:05.000000000 +0100 @@ -41,6 +41,7 @@ #include "bignum.h" #include "gmp-glue.h" +#include "rsa-internal.h" int pkcs1_decrypt (size_t key_size, @@ -48,49 +49,13 @@ size_t *length, uint8_t *message) { TMP_GMP_DECL(em, uint8_t); - uint8_t *terminator; - size_t padding; - size_t message_length; int ret; TMP_GMP_ALLOC(em, key_size); nettle_mpz_get_str_256(key_size, em, m); - /* Check format */ - if (em[0] || em[1] != 2) - { - ret = 0; - goto cleanup; - } + ret = _pkcs1_sec_decrypt_variable (length, message, key_size, em); - terminator = memchr(em + 2, 0, key_size - 2); - - if (!terminator) - { - ret = 0; - goto cleanup; - } - - padding = terminator - (em + 2); - if (padding < 8) - { - ret = 0; - goto cleanup; - } - - message_length = key_size - 3 - padding; - - if (*length < message_length) - { - ret = 0; - goto cleanup; - } - - memcpy(message, terminator + 1, message_length); - *length = message_length; - - ret = 1; -cleanup: TMP_GMP_FREE(em); return ret; } diff -Naur nettle-3.4/pkcs1-sec-decrypt.c nettle-3.4.1/pkcs1-sec-decrypt.c --- nettle-3.4/pkcs1-sec-decrypt.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/pkcs1-sec-decrypt.c 2018-12-04 21:56:05.000000000 +0100 @@ -0,0 +1,149 @@ +/* pkcs1-sec-decrypt.c + + The RSA publickey algorithm. Side channel resistant PKCS#1 decryption. + + Copyright (C) 2001, 2012 Niels Möller + Copyright (C) 2018 Red Hat, Inc. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> + +#include <string.h> + +#include "memops.h" + +#include "gmp-glue.h" +#include "rsa.h" +#include "rsa-internal.h" + +/* Inputs are always cast to uint32_t values. But all values used in this + * function should never exceed the maximum value of a uint32_t anyway. + * these macros returns 1 on success, 0 on failure */ +#define NOT_EQUAL(a, b) \ + ((0U - ((uint32_t)(a) ^ (uint32_t)(b))) >> 31) +#define EQUAL(a, b) \ + ((((uint32_t)(a) ^ (uint32_t)(b)) - 1U) >> 31) +#define GREATER_OR_EQUAL(a, b) \ + (1U - (((uint32_t)(a) - (uint32_t)(b)) >> 31)) + +int +_pkcs1_sec_decrypt (size_t length, uint8_t *message, + size_t padded_message_length, + const volatile uint8_t *padded_message) +{ + volatile int ok; + size_t i, t; + + assert (padded_message_length >= length); + + t = padded_message_length - length - 1; + + /* Check format, padding, message_size */ + ok = EQUAL(padded_message[0], 0); /* ok if padded_message[0] == 0 */ + ok &= EQUAL(padded_message[1], 2); /* ok if padded_message[1] == 2 */ + for (i = 2; i < t; i++) /* check padding has no zeros */ + { + ok &= NOT_EQUAL(padded_message[i], 0); + } + ok &= EQUAL(padded_message[t], 0); /* ok if terminator == 0 */ + + /* fill destination buffer regardless of outcome */ + cnd_memcpy(ok, message, padded_message + t + 1, length); + + return ok; +} + +int +_pkcs1_sec_decrypt_variable(size_t *length, uint8_t *message, + size_t padded_message_length, + const volatile uint8_t *padded_message) +{ + volatile int not_found = 1; + volatile int ok; + volatile size_t offset; + size_t buflen, msglen; + size_t shift, i; + + /* Check format, padding, message_size */ + ok = EQUAL(padded_message[0], 0); + ok &= EQUAL(padded_message[1], 2); + + /* length is discovered in a side-channel silent way. + * not_found goes to 0 when the terminator is found. + * offset strts at 3 as it includes the terminator and + * the fomat bytes already */ + offset = 3; + for (i = 2; i < padded_message_length; i++) + { + not_found &= NOT_EQUAL(padded_message[i], 0); + offset += not_found; + } + /* check if we ran out of buffer */ + ok &= NOT_EQUAL(not_found, 1); + /* padding must be >= 11 (2 format bytes + 8 pad bytes min. + terminator) */ + ok &= GREATER_OR_EQUAL(offset, 11); + + /* offset can vary between 3 and padded_message_length, due to the loop + * above, therefore msglen can't underflow */ + msglen = padded_message_length - offset; + + /* we always fill the whole buffer but only up to + * padded_message_length length */ + buflen = *length; + if (buflen > padded_message_length) { /* input independent branch */ + buflen = padded_message_length; + } + + /* if the message length is larger than the buffer we must fail */ + ok &= GREATER_OR_EQUAL(buflen, msglen); + + /* fill destination buffer fully regardless of outcome. Copies the message + * in a memory access independent way. The destination message buffer will + * be clobbered past the message length. */ + shift = padded_message_length - buflen; + cnd_memcpy(ok, message, padded_message + shift, buflen); + offset -= shift; + /* In this loop, the bits of the 'offset' variable are used as shifting + * conditions, starting from the least significant bit. The end result is + * that the buffer is shifted left exactly 'offset' bytes. */ + for (shift = 1; shift < buflen; shift <<= 1, offset >>= 1) + { + /* 'ok' is both a least significant bit mask and a condition */ + cnd_memcpy(offset & ok, message, message + shift, buflen - shift); + } + + /* update length only if we succeeded, otherwise leave unchanged */ + *length = (msglen & (-(size_t) ok)) + (*length & ((size_t) ok - 1)); + + return ok; +} diff -Naur nettle-3.4/rsa-decrypt-tr.c nettle-3.4.1/rsa-decrypt-tr.c --- nettle-3.4/rsa-decrypt-tr.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/rsa-decrypt-tr.c 2018-12-04 21:56:06.000000000 +0100 @@ -37,9 +37,8 @@ #endif #include "rsa.h" - -#include "bignum.h" -#include "pkcs1.h" +#include "rsa-internal.h" +#include "gmp-glue.h" int rsa_decrypt_tr(const struct rsa_public_key *pub, @@ -48,14 +47,25 @@ size_t *length, uint8_t *message, const mpz_t gibberish) { - mpz_t m; + TMP_GMP_DECL (m, mp_limb_t); + TMP_GMP_DECL (em, uint8_t); + mp_size_t key_limb_size; int res; - mpz_init_set(m, gibberish); + key_limb_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size); + + TMP_GMP_ALLOC (m, key_limb_size); + TMP_GMP_ALLOC (em, key->size); + + res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m, + mpz_limbs_read(gibberish), + mpz_size(gibberish)); + + mpn_get_base256 (em, key->size, m, key_limb_size); - res = (rsa_compute_root_tr (pub, key, random_ctx, random, m, gibberish) - && pkcs1_decrypt (key->size, m, length, message)); + res &= _pkcs1_sec_decrypt_variable (length, message, key->size, em); - mpz_clear(m); + TMP_GMP_FREE (em); + TMP_GMP_FREE (m); return res; } diff -Naur nettle-3.4/rsa.h nettle-3.4.1/rsa.h --- nettle-3.4/rsa.h 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/rsa.h 2018-12-04 21:56:06.000000000 +0100 @@ -88,6 +88,7 @@ #define rsa_encrypt nettle_rsa_encrypt #define rsa_decrypt nettle_rsa_decrypt #define rsa_decrypt_tr nettle_rsa_decrypt_tr +#define rsa_sec_decrypt nettle_rsa_sec_decrypt #define rsa_compute_root nettle_rsa_compute_root #define rsa_compute_root_tr nettle_rsa_compute_root_tr #define rsa_generate_keypair nettle_rsa_generate_keypair @@ -423,6 +424,15 @@ size_t *length, uint8_t *message, const mpz_t gibberish); +/* like rsa_decrypt_tr but with additional side-channel resistance. + * NOTE: the length of the final message must be known in advance. */ +int +rsa_sec_decrypt(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + size_t length, uint8_t *message, + const mpz_t gibberish); + /* Compute x, the e:th root of m. Calling it with x == m is allowed. */ void rsa_compute_root(const struct rsa_private_key *key, diff -Naur nettle-3.4/rsa-internal.h nettle-3.4.1/rsa-internal.h --- nettle-3.4/rsa-internal.h 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/rsa-internal.h 2018-12-04 21:56:06.000000000 +0100 @@ -0,0 +1,75 @@ +/* rsa-internal.h + + The RSA publickey algorithm. + + Copyright (C) 2001, 2002 Niels Möller + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#ifndef NETTLE_RSA_INTERNAL_H_INCLUDED +#define NETTLE_RSA_INTERNAL_H_INCLUDED + +#include "nettle-types.h" + +#include "rsa.h" + +#define _rsa_sec_compute_root_itch _nettle_rsa_sec_compute_root_itch +#define _rsa_sec_compute_root _nettle_rsa_sec_compute_root +#define _rsa_sec_compute_root_tr _nettle_rsa_sec_compute_root_tr +#define _pkcs1_sec_decrypt _nettle_pkcs1_sec_decrypt +#define _pkcs1_sec_decrypt_variable _nettle_pkcs1_sec_decrypt_variable + +/* side-channel silent root computation */ +mp_size_t +_rsa_sec_compute_root_itch(const struct rsa_private_key *key); +void +_rsa_sec_compute_root(const struct rsa_private_key *key, + mp_limb_t *rp, const mp_limb_t *mp, + mp_limb_t *scratch); + +/* Safe side-channel silent variant, using RSA blinding, and checking the + * result after CRT. */ +int +_rsa_sec_compute_root_tr(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + mp_limb_t *x, const mp_limb_t *m, size_t mn); + +/* additional resistance to memory access side-channel attacks. + * Note: message buffer is returned unchanged on error */ +int +_pkcs1_sec_decrypt (size_t length, uint8_t *message, + size_t padded_message_length, + const volatile uint8_t *padded_message); + +int +_pkcs1_sec_decrypt_variable(size_t *length, uint8_t *message, + size_t padded_message_length, + const volatile uint8_t *padded_message); + +#endif /* NETTLE_RSA_INTERNAL_H_INCLUDED */ diff -Naur nettle-3.4/rsa-sec-compute-root.c nettle-3.4.1/rsa-sec-compute-root.c --- nettle-3.4/rsa-sec-compute-root.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/rsa-sec-compute-root.c 2018-12-04 21:56:05.000000000 +0100 @@ -0,0 +1,195 @@ +/* rsa-sec-compute-root.c + + Side-channel silent RSA root computation. + + Copyright (C) 2018 Niels Möller + Copyright (C) 2018 Red Hat, Inc + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> + +#include "rsa.h" +#include "rsa-internal.h" +#include "gmp-glue.h" + +#if !NETTLE_USE_MINI_GMP +#define MAX(a, b) ((a) > (b) ? (a) : (b)) + +/* Like mpn_sec_mul_itch, monotonously increasing in operand sizes. */ +static mp_size_t +sec_mul_itch (mp_size_t an, mp_size_t bn) +{ + if (an >= bn) + return mpn_sec_mul_itch (an, bn); + else + return mpn_sec_mul_itch (bn, an); +} + +/* Writes an + bn limbs to the rp area */ +static void +sec_mul (mp_limb_t *rp, + const mp_limb_t *ap, mp_size_t an, + const mp_limb_t *bp, mp_size_t bn, mp_limb_t *scratch) +{ + if (an >= bn) + mpn_sec_mul (rp, ap, an, bp, bn, scratch); + else + mpn_sec_mul (rp, bp, bn, ap, an, scratch); +} + +static mp_size_t +sec_mod_mul_itch (mp_size_t an, mp_size_t bn, mp_size_t mn) +{ + mp_size_t mul_itch = sec_mul_itch (an, bn); + mp_size_t mod_itch = mpn_sec_div_r_itch (an + bn, mn); + return MAX(mul_itch, mod_itch); +} + +/* Sets r <-- a b % m. Needs space for an + bn limbs at rp. It is + required than an + bn >= mn. */ +static void +sec_mod_mul (mp_limb_t *rp, + const mp_limb_t *ap, mp_size_t an, + const mp_limb_t *bp, mp_size_t bn, + const mp_limb_t *mp, mp_size_t mn, + mp_limb_t *scratch) +{ + assert (an + bn >= mn); + sec_mul (rp, ap, an, bp, bn, scratch); + mpn_sec_div_r (rp, an + bn, mp, mn, scratch); +} + +static mp_size_t +sec_powm_itch (mp_size_t bn, mp_size_t en, mp_size_t mn) +{ + mp_size_t mod_itch = bn + mpn_sec_div_r_itch (bn, mn); + mp_size_t pow_itch = mn + mpn_sec_powm_itch (mn, en * GMP_NUMB_BITS, mn); + return MAX (mod_itch, pow_itch); +} + +/* Sets r <-- b ^ e % m. Performs an initial reduction b mod m, and + requires bn >= mn. */ +static void +sec_powm (mp_limb_t *rp, + const mp_limb_t *bp, mp_size_t bn, + const mp_limb_t *ep, mp_size_t en, + const mp_limb_t *mp, mp_size_t mn, mp_limb_t *scratch) +{ + assert (bn >= mn); + assert (en <= mn); + mpn_copyi (scratch, bp, bn); + mpn_sec_div_r (scratch, bn, mp, mn, scratch + bn); + mpn_sec_powm (rp, scratch, mn, ep, en * GMP_NUMB_BITS, mp, mn, + scratch + mn); +} + +mp_size_t +_rsa_sec_compute_root_itch (const struct rsa_private_key *key) +{ + mp_size_t nn = NETTLE_OCTET_SIZE_TO_LIMB_SIZE (key->size); + mp_size_t pn = mpz_size (key->p); + mp_size_t qn = mpz_size (key->q); + mp_size_t an = mpz_size (key->a); + mp_size_t bn = mpz_size (key->b); + mp_size_t cn = mpz_size (key->c); + + mp_size_t powm_p_itch = sec_powm_itch (nn, an, pn); + mp_size_t powm_q_itch = sec_powm_itch (nn, bn, qn); + mp_size_t mod_mul_itch = cn + MAX(pn, qn) + + sec_mod_mul_itch (MAX(pn, qn), cn, pn); + + mp_size_t mul_itch = sec_mul_itch (qn, pn); + mp_size_t add_1_itch = mpn_sec_add_1_itch (nn - qn); + + /* pn + qn for the product q * r_mod_p' */ + mp_size_t itch = pn + qn + MAX (mul_itch, add_1_itch); + + itch = MAX (itch, powm_p_itch); + itch = MAX (itch, powm_q_itch); + itch = MAX (itch, mod_mul_itch); + + /* pn + qn for the r_mod_p and r_mod_q temporaries. */ + return pn + qn + itch; +} + +void +_rsa_sec_compute_root (const struct rsa_private_key *key, + mp_limb_t *rp, const mp_limb_t *mp, + mp_limb_t *scratch) +{ + mp_size_t nn = NETTLE_OCTET_SIZE_TO_LIMB_SIZE (key->size); + + /* The common case is pn = qn. This function would be simpler if we + * could require that pn >= qn. */ + const mp_limb_t *pp = mpz_limbs_read (key->p); + const mp_limb_t *qp = mpz_limbs_read (key->q); + + mp_size_t pn = mpz_size (key->p); + mp_size_t qn = mpz_size (key->q); + mp_size_t an = mpz_size (key->a); + mp_size_t bn = mpz_size (key->b); + mp_size_t cn = mpz_size (key->c); + + mp_limb_t *r_mod_p = scratch; + mp_limb_t *r_mod_q = scratch + pn; + mp_limb_t *scratch_out = r_mod_q + qn; + mp_limb_t cy; + + assert (pn <= nn); + assert (qn <= nn); + assert (an <= pn); + assert (bn <= qn); + assert (cn <= pn); + + /* Compute r_mod_p = m^d % p = (m%p)^a % p */ + sec_powm (r_mod_p, mp, nn, mpz_limbs_read (key->a), an, pp, pn, scratch_out); + /* Compute r_mod_q = m^d % q = (m%q)^b % q */ + sec_powm (r_mod_q, mp, nn, mpz_limbs_read (key->b), bn, qp, qn, scratch_out); + + /* Set r_mod_p' = r_mod_p * c % p - r_mod_q * c % p . */ + sec_mod_mul (scratch_out, r_mod_p, pn, mpz_limbs_read (key->c), cn, pp, pn, + scratch_out + cn + pn); + mpn_copyi (r_mod_p, scratch_out, pn); + + sec_mod_mul (scratch_out, r_mod_q, qn, mpz_limbs_read (key->c), cn, pp, pn, + scratch_out + cn + qn); + cy = mpn_sub_n (r_mod_p, r_mod_p, scratch_out, pn); + cnd_add_n (cy, r_mod_p, pp, pn); + + /* Finally, compute x = r_mod_q + q r_mod_p' */ + sec_mul (scratch_out, qp, qn, r_mod_p, pn, scratch_out + pn + qn); + + cy = mpn_add_n (rp, scratch_out, r_mod_q, qn); + mpn_sec_add_1 (rp + qn, scratch_out + qn, nn - qn, cy, scratch_out + pn + qn); +} +#endif diff -Naur nettle-3.4/rsa-sec-decrypt.c nettle-3.4.1/rsa-sec-decrypt.c --- nettle-3.4/rsa-sec-decrypt.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/rsa-sec-decrypt.c 2018-12-04 21:56:06.000000000 +0100 @@ -0,0 +1,72 @@ +/* rsa-sec-decrypt.c + + RSA decryption, using randomized RSA blinding to be more resistant + to side-channel attacks like timing attacks or cache based memory + access measurements. + + Copyright (C) 2001, 2012 Niels Möller, Nikos Mavrogiannopoulos + Copyright (C) 2018 Red Hat, Inc. + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include "rsa.h" +#include "rsa-internal.h" + +#include "gmp-glue.h" + +int +rsa_sec_decrypt(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + size_t length, uint8_t *message, + const mpz_t gibberish) +{ + TMP_GMP_DECL (m, mp_limb_t); + TMP_GMP_DECL (em, uint8_t); + int res; + + TMP_GMP_ALLOC (m, mpz_size(pub->n)); + TMP_GMP_ALLOC (em, key->size); + + res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, m, + mpz_limbs_read(gibberish), + mpz_size(gibberish)); + + mpn_get_base256 (em, key->size, m, mpz_size(pub->n)); + + res &= _pkcs1_sec_decrypt (length, message, key->size, em); + + TMP_GMP_FREE (em); + TMP_GMP_FREE (m); + return res; +} + diff -Naur nettle-3.4/rsa-sign.c nettle-3.4.1/rsa-sign.c --- nettle-3.4/rsa-sign.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/rsa-sign.c 2018-12-04 21:56:05.000000000 +0100 @@ -35,9 +35,11 @@ # include "config.h" #endif -#include "rsa.h" +#include <assert.h> -#include "bignum.h" +#include "rsa.h" +#include "rsa-internal.h" +#include "gmp-glue.h" void rsa_private_key_init(struct rsa_private_key *key) @@ -69,7 +71,13 @@ rsa_private_key_prepare(struct rsa_private_key *key) { mpz_t n; - + + /* A key is invalid if the sizes of q and c are smaller than + * the size of n, we rely on that property in calculations so + * fail early if that happens. */ + if (mpz_size (key->q) + mpz_size (key->c) < mpz_size(key->p)) + return 0; + /* The size of the product is the sum of the sizes of the factors, * or sometimes one less. It's possible but tricky to compute the * size without computing the full product. */ @@ -80,10 +88,12 @@ key->size = _rsa_check_size(n); mpz_clear(n); - + return (key->size > 0); } +#if NETTLE_USE_MINI_GMP + /* Computing an rsa root. */ void rsa_compute_root(const struct rsa_private_key *key, @@ -142,3 +152,35 @@ mpz_clear(xp); mpz_clear(xq); } + +#else /* !NETTLE_USE_MINI_GMP */ + +/* Computing an rsa root. */ +void +rsa_compute_root(const struct rsa_private_key *key, + mpz_t x, const mpz_t m) +{ + TMP_GMP_DECL (scratch, mp_limb_t); + TMP_GMP_DECL (ml, mp_limb_t); + mp_limb_t *xl; + size_t key_size; + + key_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size); + assert(mpz_size (m) <= key_size); + + /* we need a copy because m can be shorter than key_size, + * but _rsa_sec_compute_root expect all inputs to be + * normalized to a key_size long buffer length */ + TMP_GMP_ALLOC (ml, key_size); + mpz_limbs_copy(ml, m, key_size); + + TMP_GMP_ALLOC (scratch, _rsa_sec_compute_root_itch(key)); + + xl = mpz_limbs_write (x, key_size); + _rsa_sec_compute_root (key, xl, ml, scratch); + mpz_limbs_finish (x, key_size); + + TMP_GMP_FREE (ml); + TMP_GMP_FREE (scratch); +} +#endif /* !NETTLE_USE_MINI_GMP */ diff -Naur nettle-3.4/rsa-sign-tr.c nettle-3.4.1/rsa-sign-tr.c --- nettle-3.4/rsa-sign-tr.c 2017-11-19 14:36:47.000000000 +0100 +++ nettle-3.4.1/rsa-sign-tr.c 2018-12-04 21:56:05.000000000 +0100 @@ -4,6 +4,7 @@ Copyright (C) 2001, 2015 Niels Möller Copyright (C) 2012 Nikos Mavrogiannopoulos + Copyright (C) 2018 Red Hat Inc. This file is part of GNU Nettle. @@ -36,8 +37,15 @@ # include "config.h" #endif +#include <assert.h> + +#include "gmp-glue.h" #include "rsa.h" +#include "rsa-internal.h" + +#define MAX(a, b) ((a) > (b) ? (a) : (b)) +#if NETTLE_USE_MINI_GMP /* Blinds m, by computing c = m r^e (mod n), for a random r. Also returns the inverse (ri), for use by rsa_unblind. */ static void @@ -118,3 +126,250 @@ return res; } + +int +_rsa_sec_compute_root_tr(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + mp_limb_t *x, const mp_limb_t *m, size_t mn) +{ + mpz_t mz; + mpz_t xz; + int res; + + mpz_init(mz); + mpz_init(xz); + + mpn_copyi(mpz_limbs_write(mz, mn), m, mn); + mpz_limbs_finish(mz, mn); + + res = rsa_compute_root_tr(pub, key, random_ctx, random, xz, mz); + + if (res) + mpz_limbs_copy(x, xz, mpz_size(pub->n)); + + mpz_clear(mz); + mpz_clear(xz); + return res; +} +#else +/* Blinds m, by computing c = m r^e (mod n), for a random r. Also + returns the inverse (ri), for use by rsa_unblind. */ +static void +rsa_sec_blind (const struct rsa_public_key *pub, + void *random_ctx, nettle_random_func *random, + mp_limb_t *c, mp_limb_t *ri, const mp_limb_t *m, + mp_size_t mn) +{ + const mp_limb_t *ep = mpz_limbs_read (pub->e); + const mp_limb_t *np = mpz_limbs_read (pub->n); + mp_bitcnt_t ebn = mpz_sizeinbase (pub->e, 2); + mp_size_t nn = mpz_size (pub->n); + size_t itch; + size_t i2; + mp_limb_t *scratch; + TMP_GMP_DECL (tp, mp_limb_t); + TMP_GMP_DECL (rp, mp_limb_t); + TMP_GMP_DECL (r, uint8_t); + + TMP_GMP_ALLOC (rp, nn); + TMP_GMP_ALLOC (r, nn * sizeof(mp_limb_t)); + + /* c = m*(r^e) mod n */ + itch = mpn_sec_powm_itch(nn, ebn, nn); + i2 = mpn_sec_mul_itch(nn, mn); + itch = MAX(itch, i2); + i2 = mpn_sec_div_r_itch(nn + mn, nn); + itch = MAX(itch, i2); + i2 = mpn_sec_invert_itch(nn); + itch = MAX(itch, i2); + + TMP_GMP_ALLOC (tp, nn + mn + itch); + scratch = tp + nn + mn; + + /* ri = r^(-1) */ + do + { + random(random_ctx, nn * sizeof(mp_limb_t), (uint8_t *)r); + mpn_set_base256(rp, nn, r, nn * sizeof(mp_limb_t)); + mpn_copyi(tp, rp, nn); + /* invert r */ + } + while (!mpn_sec_invert (ri, tp, np, nn, 2 * nn * GMP_NUMB_BITS, scratch)); + + mpn_sec_powm (c, rp, nn, ep, ebn, np, nn, scratch); + /* normally mn == nn, but m can be smaller in some cases */ + mpn_sec_mul (tp, c, nn, m, mn, scratch); + mpn_sec_div_r (tp, nn + mn, np, nn, scratch); + mpn_copyi(c, tp, nn); + + TMP_GMP_FREE (r); + TMP_GMP_FREE (rp); + TMP_GMP_FREE (tp); +} + +/* m = c ri mod n */ +static void +rsa_sec_unblind (const struct rsa_public_key *pub, + mp_limb_t *x, mp_limb_t *ri, const mp_limb_t *c) +{ + const mp_limb_t *np = mpz_limbs_read (pub->n); + mp_size_t nn = mpz_size (pub->n); + + size_t itch; + size_t i2; + mp_limb_t *scratch; + TMP_GMP_DECL(tp, mp_limb_t); + + itch = mpn_sec_mul_itch(nn, nn); + i2 = mpn_sec_div_r_itch(nn + nn, nn); + itch = MAX(itch, i2); + + TMP_GMP_ALLOC (tp, nn + nn + itch); + scratch = tp + nn + nn; + + mpn_sec_mul (tp, c, nn, ri, nn, scratch); + mpn_sec_div_r (tp, nn + nn, np, nn, scratch); + mpn_copyi(x, tp, nn); + + TMP_GMP_FREE (tp); +} + +static int +sec_equal(const mp_limb_t *a, const mp_limb_t *b, size_t limbs) +{ + volatile mp_limb_t z = 0; + + for (size_t i = 0; i < limbs; i++) + { + z |= (a[i] ^ b[i]); + } + + /* FIXME: Might compile to a branch instruction on some platforms. */ + return z == 0; +} + +static int +rsa_sec_check_root(const struct rsa_public_key *pub, + const mp_limb_t *x, const mp_limb_t *m) +{ + mp_size_t nn = mpz_size (pub->n); + mp_size_t ebn = mpz_sizeinbase (pub->e, 2); + const mp_limb_t *np = mpz_limbs_read (pub->n); + const mp_limb_t *ep = mpz_limbs_read (pub->e); + int ret; + + mp_size_t itch; + + mp_limb_t *scratch; + TMP_GMP_DECL(tp, mp_limb_t); + + itch = mpn_sec_powm_itch (nn, ebn, nn); + TMP_GMP_ALLOC (tp, nn + itch); + scratch = tp + nn; + + mpn_sec_powm(tp, x, nn, ep, ebn, np, nn, scratch); + ret = sec_equal(tp, m, nn); + + TMP_GMP_FREE (tp); + return ret; +} + +static void +cnd_mpn_zero (int cnd, volatile mp_ptr rp, mp_size_t n) +{ + volatile mp_limb_t c; + volatile mp_limb_t mask = (mp_limb_t) cnd - 1; + + while (--n >= 0) + { + c = rp[n]; + c &= mask; + rp[n] = c; + } +} + +/* Checks for any errors done in the RSA computation. That avoids + * attacks which rely on faults on hardware, or even software MPI + * implementation. + * This version is side-channel silent even in case of error, + * the destination buffer is always overwritten */ +int +_rsa_sec_compute_root_tr(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + mp_limb_t *x, const mp_limb_t *m, size_t mn) +{ + TMP_GMP_DECL (c, mp_limb_t); + TMP_GMP_DECL (ri, mp_limb_t); + TMP_GMP_DECL (scratch, mp_limb_t); + size_t key_limb_size; + int ret; + + key_limb_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size); + + /* mpz_powm_sec handles only odd moduli. If p, q or n is even, the + key is invalid and rejected by rsa_private_key_prepare. However, + some applications, notably gnutls, don't use this function, and + we don't want an invalid key to lead to a crash down inside + mpz_powm_sec. So do an additional check here. */ + if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q)) + { + mpn_zero(x, key_limb_size); + return 0; + } + + assert(mpz_size(pub->n) == key_limb_size); + assert(mn <= key_limb_size); + + TMP_GMP_ALLOC (c, key_limb_size); + TMP_GMP_ALLOC (ri, key_limb_size); + TMP_GMP_ALLOC (scratch, _rsa_sec_compute_root_itch(key)); + + rsa_sec_blind (pub, random_ctx, random, x, ri, m, mn); + + _rsa_sec_compute_root(key, c, x, scratch); + + ret = rsa_sec_check_root(pub, c, x); + + rsa_sec_unblind(pub, x, ri, c); + + cnd_mpn_zero(1 - ret, x, key_limb_size); + + TMP_GMP_FREE (scratch); + TMP_GMP_FREE (ri); + TMP_GMP_FREE (c); + return ret; +} + +/* Checks for any errors done in the RSA computation. That avoids + * attacks which rely on faults on hardware, or even software MPI + * implementation. + * This version is maintained for API compatibility reasons. It + * is not completely side-channel silent. There are conditionals + * in buffer copying both in case of success or error. + */ +int +rsa_compute_root_tr(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + mpz_t x, const mpz_t m) +{ + TMP_GMP_DECL (l, mp_limb_t); + int res; + + mp_size_t l_size = NETTLE_OCTET_SIZE_TO_LIMB_SIZE(key->size); + TMP_GMP_ALLOC (l, l_size); + + res = _rsa_sec_compute_root_tr (pub, key, random_ctx, random, l, + mpz_limbs_read(m), mpz_size(m)); + if (res) { + mp_limb_t *xp = mpz_limbs_write (x, l_size); + mpn_copyi (xp, l, l_size); + mpz_limbs_finish (x, l_size); + } + + TMP_GMP_FREE (l); + return res; +} +#endif diff -Naur nettle-3.4/testsuite/cnd-memcpy-test.c nettle-3.4.1/testsuite/cnd-memcpy-test.c --- nettle-3.4/testsuite/cnd-memcpy-test.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/testsuite/cnd-memcpy-test.c 2018-12-04 21:56:06.000000000 +0100 @@ -0,0 +1,47 @@ +#include "testutils.h" +#include "knuth-lfib.h" +#include "memops.h" + +#if HAVE_VALGRIND_MEMCHECK_H +# include <valgrind/memcheck.h> +static void +cnd_memcpy_for_test(int cnd, void *dst, const void *src, size_t n) +{ + /* Makes valgrind trigger on any branches depending on the input + data. */ + VALGRIND_MAKE_MEM_UNDEFINED (dst, n); + VALGRIND_MAKE_MEM_UNDEFINED (src, n); + VALGRIND_MAKE_MEM_UNDEFINED (&cnd, sizeof(cnd)); + + cnd_memcpy (cnd, dst, src, n); + VALGRIND_MAKE_MEM_DEFINED (src, n); + VALGRIND_MAKE_MEM_DEFINED (dst, n); +} +#else +#define cnd_memcpy_for_test cnd_memcpy +#endif + +#define MAX_SIZE 50 +void +test_main(void) +{ + uint8_t src[MAX_SIZE]; + uint8_t dst[MAX_SIZE]; + uint8_t res[MAX_SIZE]; + struct knuth_lfib_ctx random_ctx; + + knuth_lfib_init (&random_ctx, 11); + + size_t size; + for (size = 1; size < 50; size++) + { + knuth_lfib_random (&random_ctx, size, src); + knuth_lfib_random (&random_ctx, size, dst); + memcpy (res, dst, size); + cnd_memcpy_for_test (0, res, src, size); + + ASSERT (memcmp (res, dst, size) == 0); + cnd_memcpy_for_test (1, res, src, size); + ASSERT (memcmp (res, src, size) == 0); + } +} diff -Naur nettle-3.4/testsuite/Makefile.in nettle-3.4.1/testsuite/Makefile.in --- nettle-3.4/testsuite/Makefile.in 2017-11-19 14:36:48.000000000 +0100 +++ nettle-3.4.1/testsuite/Makefile.in 2018-12-04 21:56:06.000000000 +0100 @@ -14,6 +14,7 @@ blowfish-test.c cast128-test.c \ base16-test.c base64-test.c \ camellia-test.c chacha-test.c \ + cnd-memcpy-test.c \ des-test.c des3-test.c des-compat-test.c \ md2-test.c md4-test.c md5-test.c md5-compat-test.c \ memeql-test.c memxor-test.c gosthash94-test.c \ @@ -30,14 +31,17 @@ hmac-test.c umac-test.c \ meta-hash-test.c meta-cipher-test.c\ meta-aead-test.c meta-armor-test.c \ - buffer-test.c yarrow-test.c pbkdf2-test.c pss-mgf1-test.c + buffer-test.c yarrow-test.c pbkdf2-test.c TS_HOGWEED_SOURCES = sexp-test.c sexp-format-test.c \ rsa2sexp-test.c sexp2rsa-test.c \ bignum-test.c random-prime-test.c \ - pkcs1-test.c pss-test.c rsa-sign-tr-test.c \ - rsa-pss-sign-tr-test.c \ + pkcs1-test.c pkcs1-sec-decrypt-test.c \ + pss-test.c rsa-sign-tr-test.c \ + pss-mgf1-test.c rsa-pss-sign-tr-test.c \ rsa-test.c rsa-encrypt-test.c rsa-keygen-test.c \ + rsa-sec-decrypt-test.c \ + rsa-compute-root-test.c \ dsa-test.c dsa-keygen-test.c \ curve25519-dh-test.c \ ecc-mod-test.c ecc-modinv-test.c ecc-redc-test.c \ diff -Naur nettle-3.4/testsuite/pkcs1-sec-decrypt-test.c nettle-3.4.1/testsuite/pkcs1-sec-decrypt-test.c --- nettle-3.4/testsuite/pkcs1-sec-decrypt-test.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/testsuite/pkcs1-sec-decrypt-test.c 2018-12-04 21:56:06.000000000 +0100 @@ -0,0 +1,77 @@ +#include "testutils.h" + +#include "rsa.h" +#include "rsa-internal.h" + +#if HAVE_VALGRIND_MEMCHECK_H +# include <valgrind/memcheck.h> +static int +pkcs1_decrypt_for_test(size_t msg_len, uint8_t *msg, + size_t pad_len, uint8_t *pad) +{ + int ret; + + VALGRIND_MAKE_MEM_UNDEFINED (msg, msg_len); + VALGRIND_MAKE_MEM_UNDEFINED (pad, pad_len); + + ret = _pkcs1_sec_decrypt (msg_len, msg, pad_len, pad); + + VALGRIND_MAKE_MEM_DEFINED (msg, msg_len); + VALGRIND_MAKE_MEM_DEFINED (pad, pad_len); + VALGRIND_MAKE_MEM_DEFINED (&ret, sizeof (ret)); + + return ret; +} +#else +#define pkcs1_decrypt_for_test _pkcs1_sec_decrypt +#endif + +void +test_main(void) +{ + uint8_t pad[128]; + uint8_t buffer[] = + "\x00\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10" + "\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20" + "\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30" + "\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40" + "\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50" + "\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60" + "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70" + "\x00\x53\x49\x47\x4e\x45\x44\x20\x4d\x45\x53\x53\x41\x47\x45\x2e"; + uint8_t message[15]; + + memcpy(pad, buffer, 128); + + memset (message, 'A', 15); + ASSERT (pkcs1_decrypt_for_test(15, message, 128, pad) == 1); + ASSERT (memcmp (message, "SIGNED MESSAGE.", 15) == 0); + + /* break format byte 1 */ + memcpy(pad, buffer, 128); + pad[0] = 1; + memset (message, 'B', 15); + ASSERT (pkcs1_decrypt_for_test(15, message, 128, pad) == 0); + ASSERT (memcmp (message, "BBBBBBBBBBBBBBB", 15) == 0); + + /* break format byte 2 */ + memcpy(pad, buffer, 128); + pad[1] = 1; + memset (message, 'C', 15); + ASSERT (pkcs1_decrypt_for_test(15, message, 128, pad) == 0); + ASSERT (memcmp (message, "CCCCCCCCCCCCCCC", 15) == 0); + + /* break padding */ + memcpy(pad, buffer, 128); + pad[24] = 0; + memset (message, 'D', 15); + ASSERT (pkcs1_decrypt_for_test(15, message, 128, pad) == 0); + ASSERT (memcmp (message, "DDDDDDDDDDDDDDD", 15) == 0); + + /* break terminator */ + memcpy(pad, buffer, 128); + pad[112] = 1; + memset (message, 'E', 15); + ASSERT (pkcs1_decrypt_for_test(15, message, 128, pad) == 0); + ASSERT (memcmp (message, "EEEEEEEEEEEEEEE", 15) == 0); +} diff -Naur nettle-3.4/testsuite/rsa-compute-root-test.c nettle-3.4.1/testsuite/rsa-compute-root-test.c --- nettle-3.4/testsuite/rsa-compute-root-test.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/testsuite/rsa-compute-root-test.c 2018-12-04 21:56:06.000000000 +0100 @@ -0,0 +1,234 @@ +#include "testutils.h" + +#include <assert.h> +#include <errno.h> +#include <limits.h> +#include <sys/time.h> + +#include "rsa.h" + +#define KEY_COUNT 20 +#define COUNT 100 + +static void +random_fn (void *ctx, size_t n, uint8_t *dst) +{ + gmp_randstate_t *rands = (gmp_randstate_t *)ctx; + mpz_t r; + + mpz_init (r); + mpz_urandomb (r, *rands, n*8); + nettle_mpz_get_str_256 (n, dst, r); + mpz_clear (r); +} + +static void +test_one (gmp_randstate_t *rands, struct rsa_public_key *pub, + struct rsa_private_key *key, mpz_t plaintext) +{ + mpz_t ciphertext; + mpz_t decrypted; + + mpz_init (ciphertext); + mpz_init (decrypted); + + mpz_powm (ciphertext, plaintext, pub->e, pub->n); + rsa_compute_root_tr (pub, key, rands, random_fn, decrypted, ciphertext); + if (mpz_cmp (plaintext, decrypted)) { + fprintf (stderr, "rsa_compute_root_tr failed\n"); + + fprintf(stderr, "Public key: size=%lu\n n:", pub->size); + mpz_out_str (stderr, 10, pub->n); + fprintf(stderr, "\n e:"); + mpz_out_str (stderr, 10, pub->e); + fprintf(stderr, "\nPrivate key: size=%lu\n p:", key->size); + mpz_out_str (stderr, 10, key->p); + fprintf(stderr, "\n q:"); + mpz_out_str (stderr, 10, key->q); + fprintf(stderr, "\n a:"); + mpz_out_str (stderr, 10, key->a); + fprintf(stderr, "\n b:"); + mpz_out_str (stderr, 10, key->b); + fprintf(stderr, "\n c:"); + mpz_out_str (stderr, 10, key->c); + fprintf(stderr, "\n d:"); + mpz_out_str (stderr, 10, key->d); + fprintf(stderr, "\n"); + + fprintf (stderr, "plaintext(%lu) = ", mpz_sizeinbase (plaintext, 2)); + mpz_out_str (stderr, 10, plaintext); + fprintf (stderr, "\n"); + fprintf (stderr, "ciphertext(%lu) = ", mpz_sizeinbase (ciphertext, 2)); + mpz_out_str (stderr, 10, ciphertext); + fprintf (stderr, "\n"); + fprintf (stderr, "decrypted(%lu) = ", mpz_sizeinbase (decrypted, 2)); + mpz_out_str (stderr, 10, decrypted); + fprintf (stderr, "\n"); + abort(); + } + + mpz_clear (ciphertext); + mpz_clear (decrypted); +} + +#if !NETTLE_USE_MINI_GMP +/* We want to generate keypairs that are not "standard" but have more size + * variance between q and p. + * Function is otherwise the same as standard rsa_generate_keypair() + */ +static void +generate_keypair (gmp_randstate_t rands, + struct rsa_public_key *pub, struct rsa_private_key *key) +{ + unsigned long int psize; + unsigned long int qsize; + mpz_t p1; + mpz_t q1; + mpz_t phi; + mpz_t tmp; + + mpz_init (p1); + mpz_init (q1); + mpz_init (phi); + mpz_init (tmp); + + psize = 100 + gmp_urandomm_ui (rands, 400); + qsize = 100 + gmp_urandomm_ui (rands, 400); + + mpz_set_ui (pub->e, 65537); + + for (;;) + { + for (;;) + { + mpz_rrandomb (key->p, rands, psize); + mpz_nextprime (key->p, key->p); + mpz_sub_ui (p1, key->p, 1); + mpz_gcd (tmp, pub->e, p1); + if (mpz_cmp_ui (tmp, 1) == 0) + break; + } + + for (;;) + { + mpz_rrandomb (key->q, rands, qsize); + mpz_nextprime (key->q, key->q); + mpz_sub_ui (q1, key->q, 1); + mpz_gcd (tmp, pub->e, q1); + if (mpz_cmp_ui (tmp, 1) == 0) + break; + } + + if (mpz_invert (key->c, key->q, key->p)) + break; + } + + mpz_mul(phi, p1, q1); + assert (mpz_invert(key->d, pub->e, phi)); + + mpz_fdiv_r (key->a, key->d, p1); + mpz_fdiv_r (key->b, key->d, q1); + + mpz_mul (pub->n, key->p, key->q); + + pub->size = key->size = mpz_size(pub->n) * sizeof(mp_limb_t); + + mpz_clear (tmp); + mpz_clear (phi); + mpz_clear (q1); + mpz_clear (p1); +} +#endif + +#if !NETTLE_USE_MINI_GMP +static void +get_random_seed(mpz_t seed) +{ + struct timeval tv; + FILE *f; + f = fopen ("/dev/urandom", "rb"); + if (f) + { + uint8_t buf[8]; + size_t res; + + setbuf (f, NULL); + res = fread (&buf, sizeof(buf), 1, f); + fclose(f); + if (res == 1) + { + nettle_mpz_set_str_256_u (seed, sizeof(buf), buf); + return; + } + fprintf (stderr, "Read of /dev/urandom failed: %s\n", + strerror (errno)); + } + gettimeofday(&tv, NULL); + mpz_set_ui (seed, tv.tv_sec); + mpz_mul_ui (seed, seed, 1000000UL); + mpz_add_ui (seed, seed, tv.tv_usec); +} +#endif /* !NETTLE_USE_MINI_GMP */ + +void +test_main (void) +{ + const char *nettle_test_seed; + gmp_randstate_t rands; + struct rsa_public_key pub; + struct rsa_private_key key; + mpz_t plaintext; + unsigned i, j; + + rsa_private_key_init(&key); + rsa_public_key_init(&pub); + mpz_init (plaintext); + + gmp_randinit_default (rands); + +#if !NETTLE_USE_MINI_GMP + nettle_test_seed = getenv ("NETTLE_TEST_SEED"); + if (nettle_test_seed && *nettle_test_seed) + { + mpz_t seed; + mpz_init (seed); + if (mpz_set_str (seed, nettle_test_seed, 0) < 0 + || mpz_sgn (seed) < 0) + die ("Invalid NETTLE_TEST_SEED: %s\n", + nettle_test_seed); + if (mpz_sgn (seed) == 0) + get_random_seed (seed); + fprintf (stderr, "Using NETTLE_TEST_SEED="); + mpz_out_str (stderr, 10, seed); + fprintf (stderr, "\n"); + + gmp_randseed (rands, seed); + mpz_clear (seed); + } +#endif + + for (j = 0; j < KEY_COUNT; j++) + { +#if !NETTLE_USE_MINI_GMP + generate_keypair(rands, &pub, &key); +#else + rsa_generate_keypair(&pub, &key, &rands, random_fn, NULL, NULL, 512, 16); +#endif /* !NETTLE_USE_MINI_GMP */ + + for (i = 0; i < COUNT; i++) + { + mpz_urandomb(plaintext, rands, mpz_sizeinbase(pub.n, 2) - 1); + test_one(&rands, &pub, &key, plaintext); + } + for (i = 0; i < COUNT; i++) + { + mpz_rrandomb(plaintext, rands, mpz_sizeinbase(pub.n, 2) - 1); + test_one(&rands, &pub, &key, plaintext); + } + } + mpz_clear (plaintext); + rsa_public_key_clear (&pub); + rsa_private_key_clear (&key); + + gmp_randclear (rands); +} diff -Naur nettle-3.4/testsuite/rsa-encrypt-test.c nettle-3.4.1/testsuite/rsa-encrypt-test.c --- nettle-3.4/testsuite/rsa-encrypt-test.c 2017-11-19 14:36:48.000000000 +0100 +++ nettle-3.4.1/testsuite/rsa-encrypt-test.c 2018-12-04 21:56:06.000000000 +0100 @@ -30,6 +30,8 @@ if (verbose) fprintf(stderr, "msg: `%s', length = %d\n", msg, (int) msg_length); + + ASSERT(msg_length <= key.size); ASSERT(rsa_encrypt(&pub, &lfib, (nettle_random_func *) knuth_lfib_random, @@ -42,7 +44,7 @@ mpz_out_str(stderr, 10, gibberish); } - decrypted = xalloc(msg_length + 1); + decrypted = xalloc(key.size + 1); knuth_lfib_random (&lfib, msg_length + 1, decrypted); after = decrypted[msg_length]; @@ -56,14 +58,14 @@ ASSERT(MEMEQ(msg_length, msg, decrypted)); ASSERT(decrypted[msg_length] == after); - knuth_lfib_random (&lfib, msg_length + 1, decrypted); - after = decrypted[msg_length]; + knuth_lfib_random (&lfib, key.size + 1, decrypted); + after = decrypted[key.size]; decrypted_length = key.size; ASSERT(rsa_decrypt(&key, &decrypted_length, decrypted, gibberish)); ASSERT(decrypted_length == msg_length); ASSERT(MEMEQ(msg_length, msg, decrypted)); - ASSERT(decrypted[msg_length] == after); + ASSERT(decrypted[key.size] == after); knuth_lfib_random (&lfib, msg_length + 1, decrypted); after = decrypted[msg_length]; @@ -76,6 +78,30 @@ ASSERT(MEMEQ(msg_length, msg, decrypted)); ASSERT(decrypted[msg_length] == after); + /* test side channel resistant variant */ + knuth_lfib_random (&lfib, msg_length + 1, decrypted); + after = decrypted[msg_length]; + decrypted_length = msg_length; + + ASSERT(rsa_sec_decrypt(&pub, &key, + &lfib, (nettle_random_func *) knuth_lfib_random, + decrypted_length, decrypted, gibberish)); + ASSERT(MEMEQ(msg_length, msg, decrypted)); + ASSERT(decrypted[msg_length] == after); + + /* test invalid length to rsa_sec_decrypt */ + knuth_lfib_random (&lfib, msg_length + 1, decrypted); + decrypted_length = msg_length - 1; + after = decrypted[decrypted_length] = 'X'; + decrypted[0] = 'A'; + + ASSERT(!rsa_sec_decrypt(&pub, &key, + &lfib, (nettle_random_func *) knuth_lfib_random, + decrypted_length, decrypted, gibberish)); + ASSERT(decrypted[decrypted_length] == after); + ASSERT(decrypted[0] == 'A'); + + /* Test invalid key. */ mpz_add_ui (key.q, key.q, 2); decrypted_length = key.size; diff -Naur nettle-3.4/testsuite/rsa-sec-decrypt-test.c nettle-3.4.1/testsuite/rsa-sec-decrypt-test.c --- nettle-3.4/testsuite/rsa-sec-decrypt-test.c 1970-01-01 01:00:00.000000000 +0100 +++ nettle-3.4.1/testsuite/rsa-sec-decrypt-test.c 2018-12-04 21:56:06.000000000 +0100 @@ -0,0 +1,118 @@ +#include "testutils.h" + +#include "rsa.h" +#include "knuth-lfib.h" + +#if HAVE_VALGRIND_MEMCHECK_H +# include <valgrind/memcheck.h> + +#define MARK_MPZ_LIMBS_UNDEFINED(parm) \ + VALGRIND_MAKE_MEM_UNDEFINED (mpz_limbs_read (parm), \ + mpz_size (parm) * sizeof (mp_limb_t)) +#define MARK_MPZ_LIMBS_DEFINED(parm) \ + VALGRIND_MAKE_MEM_DEFINED (mpz_limbs_read (parm), \ + mpz_size (parm) * sizeof (mp_limb_t)) +static int +rsa_decrypt_for_test(const struct rsa_public_key *pub, + const struct rsa_private_key *key, + void *random_ctx, nettle_random_func *random, + size_t length, uint8_t *message, + const mpz_t gibberish) +{ + int ret; + /* Makes valgrind trigger on any branches depending on the input + data. Except that (i) we have to allow rsa_sec_compute_root_tr to + check that p and q are odd, (ii) mpn_sec_div_r may leak + information about the most significant bits of p and q, due to + normalization check and table lookup in invert_limb, and (iii) + mpn_sec_powm may leak information about the least significant + bits of p and q, due to table lookup in binvert_limb. */ + VALGRIND_MAKE_MEM_UNDEFINED (message, length); + MARK_MPZ_LIMBS_UNDEFINED(gibberish); + MARK_MPZ_LIMBS_UNDEFINED(key->a); + MARK_MPZ_LIMBS_UNDEFINED(key->b); + MARK_MPZ_LIMBS_UNDEFINED(key->c); + VALGRIND_MAKE_MEM_UNDEFINED(mpz_limbs_read (key->p) + 1, + (mpz_size (key->p) - 3) * sizeof(mp_limb_t)); + VALGRIND_MAKE_MEM_UNDEFINED(mpz_limbs_read (key->q) + 1, + (mpz_size (key->q) - 3) * sizeof(mp_limb_t)); + + ret = rsa_sec_decrypt (pub, key, random_ctx, random, length, message, gibberish); + + VALGRIND_MAKE_MEM_DEFINED (message, length); + VALGRIND_MAKE_MEM_DEFINED (&ret, sizeof(ret)); + MARK_MPZ_LIMBS_DEFINED(gibberish); + MARK_MPZ_LIMBS_DEFINED(key->a); + MARK_MPZ_LIMBS_DEFINED(key->b); + MARK_MPZ_LIMBS_DEFINED(key->c); + MARK_MPZ_LIMBS_DEFINED(key->p); + MARK_MPZ_LIMBS_DEFINED(key->q); + + return ret; +} +#else +#define rsa_decrypt_for_test rsa_sec_decrypt +#endif + +#define PAYLOAD_SIZE 50 +void +test_main(void) +{ + struct rsa_public_key pub; + struct rsa_private_key key; + struct knuth_lfib_ctx random_ctx; + + uint8_t plaintext[PAYLOAD_SIZE]; + uint8_t decrypted[PAYLOAD_SIZE]; + uint8_t verifybad[PAYLOAD_SIZE]; + unsigned n_size = 1024; + mpz_t gibberish; + mpz_t garbage; + + rsa_private_key_init(&key); + rsa_public_key_init(&pub); + mpz_init(gibberish); + mpz_init(garbage); + + knuth_lfib_init (&random_ctx, 19); + + memset(verifybad, 'A', PAYLOAD_SIZE); + + for (size_t size = 1; size < 51; size++) + { + ASSERT (rsa_generate_keypair(&pub, &key, &random_ctx, + (nettle_random_func *) knuth_lfib_random, + NULL, NULL, n_size, 17)); + + /* the next key will be 19 bits larger */ + n_size += 19; + + knuth_lfib_random (&random_ctx, PAYLOAD_SIZE, plaintext); + ASSERT(rsa_encrypt(&pub, &random_ctx, + (nettle_random_func *) knuth_lfib_random, + PAYLOAD_SIZE, plaintext, gibberish)); + + /* good decryption */ + ASSERT (rsa_decrypt_for_test (&pub, &key, &random_ctx, + (nettle_random_func *) knuth_lfib_random, + PAYLOAD_SIZE, decrypted, gibberish) == 1); + ASSERT (MEMEQ (PAYLOAD_SIZE, plaintext, decrypted)); + + /* bad one */ + memcpy(decrypted, verifybad, PAYLOAD_SIZE); + nettle_mpz_random_size(garbage, &random_ctx, + (nettle_random_func *) knuth_lfib_random, + mpz_sizeinbase(gibberish, 2)); + + ASSERT (rsa_decrypt_for_test (&pub, &key, &random_ctx, + (nettle_random_func *) knuth_lfib_random, + PAYLOAD_SIZE, decrypted, garbage) == 0); + ASSERT (MEMEQ (PAYLOAD_SIZE, verifybad, decrypted)); + } + + rsa_private_key_clear(&key); + rsa_public_key_clear(&pub); + mpz_clear(gibberish); + mpz_clear(garbage); +} + diff -Naur nettle-3.4/testsuite/.test-rules.make nettle-3.4.1/testsuite/.test-rules.make --- nettle-3.4/testsuite/.test-rules.make 2017-11-19 14:36:48.000000000 +0100 +++ nettle-3.4.1/testsuite/.test-rules.make 2018-12-04 21:56:06.000000000 +0100 @@ -25,6 +25,9 @@ chacha-test$(EXEEXT): chacha-test.$(OBJEXT) $(LINK) chacha-test.$(OBJEXT) $(TEST_OBJS) -o chacha-test$(EXEEXT) +cnd-memcpy-test$(EXEEXT): cnd-memcpy-test.$(OBJEXT) + $(LINK) cnd-memcpy-test.$(OBJEXT) $(TEST_OBJS) -o cnd-memcpy-test$(EXEEXT) + des-test$(EXEEXT): des-test.$(OBJEXT) $(LINK) des-test.$(OBJEXT) $(TEST_OBJS) -o des-test$(EXEEXT) @@ -163,9 +166,6 @@ pbkdf2-test$(EXEEXT): pbkdf2-test.$(OBJEXT) $(LINK) pbkdf2-test.$(OBJEXT) $(TEST_OBJS) -o pbkdf2-test$(EXEEXT) -pss-mgf1-test$(EXEEXT): pss-mgf1-test.$(OBJEXT) - $(LINK) pss-mgf1-test.$(OBJEXT) $(TEST_OBJS) -o pss-mgf1-test$(EXEEXT) - sexp-test$(EXEEXT): sexp-test.$(OBJEXT) $(LINK) sexp-test.$(OBJEXT) $(TEST_OBJS) -o sexp-test$(EXEEXT) @@ -187,12 +187,18 @@ pkcs1-test$(EXEEXT): pkcs1-test.$(OBJEXT) $(LINK) pkcs1-test.$(OBJEXT) $(TEST_OBJS) -o pkcs1-test$(EXEEXT) +pkcs1-sec-decrypt-test$(EXEEXT): pkcs1-sec-decrypt-test.$(OBJEXT) + $(LINK) pkcs1-sec-decrypt-test.$(OBJEXT) $(TEST_OBJS) -o pkcs1-sec-decrypt-test$(EXEEXT) + pss-test$(EXEEXT): pss-test.$(OBJEXT) $(LINK) pss-test.$(OBJEXT) $(TEST_OBJS) -o pss-test$(EXEEXT) rsa-sign-tr-test$(EXEEXT): rsa-sign-tr-test.$(OBJEXT) $(LINK) rsa-sign-tr-test.$(OBJEXT) $(TEST_OBJS) -o rsa-sign-tr-test$(EXEEXT) +pss-mgf1-test$(EXEEXT): pss-mgf1-test.$(OBJEXT) + $(LINK) pss-mgf1-test.$(OBJEXT) $(TEST_OBJS) -o pss-mgf1-test$(EXEEXT) + rsa-pss-sign-tr-test$(EXEEXT): rsa-pss-sign-tr-test.$(OBJEXT) $(LINK) rsa-pss-sign-tr-test.$(OBJEXT) $(TEST_OBJS) -o rsa-pss-sign-tr-test$(EXEEXT) @@ -205,6 +211,12 @@ rsa-keygen-test$(EXEEXT): rsa-keygen-test.$(OBJEXT) $(LINK) rsa-keygen-test.$(OBJEXT) $(TEST_OBJS) -o rsa-keygen-test$(EXEEXT) +rsa-sec-decrypt-test$(EXEEXT): rsa-sec-decrypt-test.$(OBJEXT) + $(LINK) rsa-sec-decrypt-test.$(OBJEXT) $(TEST_OBJS) -o rsa-sec-decrypt-test$(EXEEXT) + +rsa-compute-root-test$(EXEEXT): rsa-compute-root-test.$(OBJEXT) + $(LINK) rsa-compute-root-test.$(OBJEXT) $(TEST_OBJS) -o rsa-compute-root-test$(EXEEXT) + dsa-test$(EXEEXT): dsa-test.$(OBJEXT) $(LINK) dsa-test.$(OBJEXT) $(TEST_OBJS) -o dsa-test$(EXEEXT) diff -Naur nettle-3.4/testsuite/testutils.c nettle-3.4.1/testsuite/testutils.c --- nettle-3.4/testsuite/testutils.c 2017-11-19 14:36:48.000000000 +0100 +++ nettle-3.4.1/testsuite/testutils.c 2018-12-04 21:56:06.000000000 +0100 @@ -818,7 +818,7 @@ uint8_t *buf = xalloc (bytes); knuth_lfib_random (ctx, bytes, buf); - buf[bytes-1] &= 0xff >> (8*bytes - bits); + buf[0] &= 0xff >> (8*bytes - bits); nettle_mpz_set_str_256_u (r, bytes, buf); free (buf); } diff -Naur nettle-3.4/tools/pkcs1-conv.c nettle-3.4.1/tools/pkcs1-conv.c --- nettle-3.4/tools/pkcs1-conv.c 2017-11-19 14:36:48.000000000 +0100 +++ nettle-3.4.1/tools/pkcs1-conv.c 2018-12-04 21:56:06.000000000 +0100 @@ -563,28 +563,20 @@ { case 10: if (memcmp(marker, "PUBLIC KEY", 10) == 0) - { - type = GENERAL_PUBLIC_KEY; - break; - } + type = GENERAL_PUBLIC_KEY; + break; + case 14: if (memcmp(marker, "RSA PUBLIC KEY", 14) == 0) - { - type = RSA_PUBLIC_KEY; - break; - } + type = RSA_PUBLIC_KEY; + break; case 15: if (memcmp(marker, "RSA PRIVATE KEY", 15) == 0) - { - type = RSA_PRIVATE_KEY; - break; - } - if (memcmp(marker, "DSA PRIVATE KEY", 15) == 0) - { - type = DSA_PRIVATE_KEY; - break; - } + type = RSA_PRIVATE_KEY; + else if (memcmp(marker, "DSA PRIVATE KEY", 15) == 0) + type = DSA_PRIVATE_KEY; + break; } if (!type)
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
