aboutsummaryrefslogtreecommitdiff
path: root/crypto/bn
AgeCommit message (Collapse)AuthorFilesLines
2023-10-24Copyright year updatesMatt Caswell1-1/+1
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-10-05BN_gcd(): Avoid shifts of negative valuesTomas Mraz1-3/+3
Fixes #22216 Thanks to Leland Mills for investigation and testing. Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22272) (cherry picked from commit 0f7a3b0caa33a87c900536dc1c02fa553d2193cc)
2023-09-19Copyright year updatesRichard Levitte2-2/+2
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-08-01Backport crypto/armcap.c from master branchTom Cosgrove2-2/+2
This backports 7b508cd1e1 together with .pl fixes Makes the SIGILL-based code easier to read, and doesn't use it on Apple Silicon or where getauxval() is present, thereby improving stability when debugging on Darwin (macOS/iOS/etc) and in multi-threaded programs (both Darwin and Linux). Fixes #21541 Change-Id: I07912f0ddcbfe15bf3c1550533855a6583d21b67 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21583)
2023-08-01Copyright year updatesMatt Caswell1-1/+1
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-06-26Check for 0 modulus in BN_RECP_CTX_set.fullwaywang1-1/+1
The function BN_RECP_CTX_set did not check whether arg d is zero, in which case an early failure should be returned to the invoker. This is a similar fix to the cognate defect of CVE-2015-1794. Fixes #21111 CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21255) (cherry picked from commit 43596b306b1fe06da3b1a99e07c0cf235898010d)
2023-05-30Update copyright yearTomas Mraz6-6/+6
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-04-18bn_local: remove unused `PTR_SIZE_INT` definitionAlois Klink1-18/+0
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748) (cherry picked from commit dcfeb617477dd957f69e713cbc61fd4dca0f2db4)
2023-04-18bn_nist: remove unused type-punning union `u`Alois Klink1-21/+12
We no longer need to cast function pointers to PTR_SIZE_INT. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748) (cherry picked from commit f659f7a1c70709caa1727bb0b7f836d170d35bb5)
2023-04-18bn_nist: replace pointer bit-fiddling with ternaryAlois Klink1-45/+19
Bit-fiddling pointers is technically implementation defined behavior in the C specification so the following code is not supported in all platforms: PTR_SIZE_INT mask; void * a, b, c; int boolean_flag; mask = 0 - boolean_flag; /* Not guaranteed to be a valid ptr to a or b on all platforms */ a = (void *) ((((PTR_SIZE_INT) b & ~mask) | (((PTR_SIZE_INT)) c & mask))); Using a ternary conditional operator is supported on all platforms (i.e. `a = boolean_flag ? b : c;`). On most modern compilers/CPUs, this will be faster, since it will get converted to a CMOV instruction. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20748) (cherry picked from commit 326af4ad171b849ba1e76fd425d8f337718c4108)
2023-04-04Alternative fix for CVE-2022-4304Bernd Edlinger4-62/+95
This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20282)
2023-04-04Revert "Fix Timing Oracle in RSA decryption"Bernd Edlinger4-650/+15
This reverts commit 8022a4799fe884b3bf8d538e2b4c4ec323663118. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20282)
2023-03-17rsaz-*k-avx512.pl: fix wrong name of avx512 flag variableTomas Mraz3-6/+6
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20519)
2023-03-17Fix version detection on Apple clangTomas Mraz2-4/+22
Added missing fix from the master branch. Fixes #20518 Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20519)
2023-03-15Add missing copyright headerPauli1-0/+9
This file was only recently introduced and the missing header slipped through the review process. Fixes #20461 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20470) (cherry picked from commit 93b0a1ea614f9ce3931373fd3d1d1af04795e6d7)
2023-03-14Update copyright yearMatt Caswell7-7/+7
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/20508)
2023-02-20Fix incorrect error branch in ossl_bn_rsa_fips186_4_derive_prime()ndossche1-1/+1
BN_priv_rand_range_ex() and BN_add() both return a 0 on failure and a 1 on success. In case of failure, the algorithm should fail. However, the branch that it goes through on failure is "goto end", not "goto err". Therefore, the algorithm will return 1 which indicates success instead of 0 for failure, leading to potential problems for the callers. Fix it by changing the goto to "goto err" instead of "goto end". CLA: trivial Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20279) (cherry picked from commit 835b90a19cdb2901cdba8a26955ccaacf0d73062)
2023-02-11rsa: add msvc intrinsic for non x64 platformsHubert Kario1-1/+23
_umul128() is x86_64 (x64) only, while __umulh() works everywhere, but doesn't generate optimal code on x64 Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20244) (cherry picked from commit 075652f224479dad2e64b92e791b296177af8705)
2023-02-07Fix Timing Oracle in RSA decryptionDmitry Belyavskiy4-15/+619
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. Patch written by Dmitry Belyavsky and Hubert Kario CVE-2022-4304 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-01-31Avoid duplicating symbols in legacy.a with some build optionsTomas Mraz1-5/+0
If no-module or no-shared is used, the symbols from libcrypto should not be duplicated in legacy.a Also the BIGNUM functions are currently not needed in legacy.a at all. Fixes #20124 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20137) (cherry picked from commit f6a6f7b6aa84dab44384780cb77050d15c5f575e)
2023-01-14Limit size of modulus for bn_mul_mont and BN_mod_exp_mont_consttimeBernd Edlinger3-8/+48
Otherwise the alloca can cause an exception. Issue reported by Jiayi Lin. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005) (cherry picked from commit 30667f5c306dbc11ac0e6fddc7d26fd984d546ab)
2023-01-14Revert "Limit size of modulus for BN_mod_exp_mont_consttime()"Bernd Edlinger1-9/+0
This reverts commit 4378e3cd2a4d73a97a2349efaa143059d8ed05e8. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/20005) (cherry picked from commit 92d306b32b63dd502531a89fb96c4172be0ddb49)
2023-01-09rsaz_exp_x2.c: Remove unused ALIGN64 macroTomas Mraz1-8/+0
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19597) (cherry picked from commit 4b65d79d7132d6e46bfb385a76082f6502ef617b)
2023-01-09rsaz_exp_x2.c: Avoid potential undefined behavior with strict aliasingTomas Mraz1-4/+12
Fixes #19584 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19597) (cherry picked from commit 9506a2e274c643b94a2c265019ea9288f99a521a)
2023-01-09Revert "Fix an occasional CI failure due to unaligned access"Tomas Mraz1-14/+4
This reverts commit 8511520842b744d1794ea794c032ce5f78cd874b. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19597) (cherry picked from commit f83490fb9ce4dd1c09d4f94526fbcad14bd2fd85)
2023-01-04Cleanse internal BN_generate_dsa_nonce() buffers used to generate k.slontis1-1/+3
Fixes #9205 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19954) (cherry picked from commit 177d433bda2ffd287d676bc53b549b6c246973e6)
2022-12-01Update copyright yearTomas Mraz7-7/+7
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19803)
2022-11-23crypto/*: Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY1-1/+1
partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - host name -> hostname - ipv6 -> IPv6 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059) (cherry picked from commit c7340583097a80a4fe42bacea745b2bbaa6d16db)
2022-11-23crypto: Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY1-2/+2
partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - file name -> filename - host name -> hostname Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059) (cherry picked from commit 1567a821a4616f59748fa8982724f88e542867d6)
2022-11-23Fix unrolled montgomery multiplication for POWER9Rohan McLure1-2/+4
In the reference C implementation in bn_asm.c, tp[num + 1] contains the carry bit for accumulations into tp[num]. tp[num + 1] is only ever assigned, never itself incremented. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18883) (cherry picked from commit 2f1112b22a826dc8854b41b60a422c987f8ddafb)
2022-11-23Revert "Revert "bn: Add fixed length (n=6), unrolled PPC Montgomery ↵Rohan McLure3-1/+598
Multiplication"" This reverts commit 712d9cc90e355b2c98a959d4e9398610d2269c9e. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18883) (cherry picked from commit eae70100fadbc94f18ba7a729bf065cb524a9fc9)
2022-11-23Improve FIPS RSA keygen performance.slontis2-8/+52
Reduce the Miller Rabin counts to the values specified by FIPS 186-5. The old code was using a fixed value of 64. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19579) (cherry picked from commit d2f6e66d2837bff1f5f7636bb2118e3a45c9df61)
2022-11-21Improve FIPS RSA keygen performance.slontis2-9/+46
FIPS 186-4 has 5 different algorithms for key generation, and all of them rely on testing GCD(a,n) == 1 many times. Cachegrind was showing that during a RSA keygen operation, the function BN_gcd() was taking a considerable percentage of the total cycles. The default provider uses multiprime keygen, which seemed to be much faster. This is because it uses BN_mod_inverse() instead. For a 4096 bit key, the entropy of a key that was taking a long time to generate was recorded and fed back into subsequent runs. Roughly 40% of the cycle time was BN_gcd() with most of the remainder in the prime testing. Changing to use the inverse resulted in the cycle count being 96% in the prime testing. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19578) (cherry picked from commit dd1d7bcb69994d81662e709b0ad838880b943870)
2022-11-21[crypto/bn] BN_consttime_swap: remove superfluous early exitBilly Brumley1-3/+0
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18518) (cherry picked from commit a644cb7c1c19c78e2ca393c8ca36989e7ca61715)
2022-11-10Limit size of modulus for BN_mod_exp_mont_consttime()Tomas Mraz1-0/+9
Otherwise the powerbufLen can overflow. Issue reported by Jiayi Lin. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/19632) (cherry picked from commit 4378e3cd2a4d73a97a2349efaa143059d8ed05e8)
2022-11-09Fix typosDimitris Apostolou3-3/+3
Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17392) (cherry picked from commit e304aa87b35fac5ea97c405dd3c21549faa45e78)
2022-11-09Remove some unnecessary undefs in bn_asm.cBernd Edlinger1-7/+0
This is likely the leftover of a previous hack, and thus should be removed now. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17259) (cherry picked from commit 17cca0e85e83eac23069ddc5c5ebab6d7dd13ee1) Reviewed-by: Hugo Landau <hlandau@openssl.org>
2022-11-09Dual 1536/2048-bit exponentiation optimization for Intel IceLake CPUAndrey Matyukov6-330/+2224
It uses AVX512_IFMA + AVX512_VL (with 256-bit wide registers) ISA to keep lower power license. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14908) (cherry picked from commit f87b4c4ea67393c9269663ed40a7ea3463cc59d3)
2022-11-09aarch64: support BTI and pointer authentication in assemblyRuss Butler1-5/+14
This change adds optional support for - Armv8.3-A Pointer Authentication (PAuth) and - Armv8.5-A Branch Target Identification (BTI) features to the perl scripts. Both features can be enabled with additional compiler flags. Unless any of these are enabled explicitly there is no code change at all. The extensions are briefly described below. Please read the appropriate chapters of the Arm Architecture Reference Manual for the complete specification. Scope ----- This change only affects generated assembly code. Armv8.3-A Pointer Authentication -------------------------------- Pointer Authentication extension supports the authentication of the contents of registers before they are used for indirect branching or load. PAuth provides a probabilistic method to detect corruption of register values. PAuth signing instructions generate a Pointer Authentication Code (PAC) based on the value of a register, a seed and a key. The generated PAC is inserted into the original value in the register. A PAuth authentication instruction recomputes the PAC, and if it matches the PAC in the register, restores its original value. In case of a mismatch, an architecturally unmapped address is generated instead. With PAuth, mitigation against ROP (Return-oriented Programming) attacks can be implemented. This is achieved by signing the contents of the link-register (LR) before it is pushed to stack. Once LR is popped, it is authenticated. This way a stack corruption which overwrites the LR on the stack is detectable. The PAuth extension adds several new instructions, some of which are not recognized by older hardware. To support a single codebase for both pre Armv8.3-A targets and newer ones, only NOP-space instructions are added by this patch. These instructions are treated as NOPs on hardware which does not support Armv8.3-A. Furthermore, this patch only considers cases where LR is saved to the stack and then restored before branching to its content. There are cases in the code where LR is pushed to stack but it is not used later. We do not address these cases as they are not affected by PAuth. There are two keys available to sign an instruction address: A and B. PACIASP and PACIBSP only differ in the used keys: A and B, respectively. The keys are typically managed by the operating system. To enable generating code for PAuth compile with -mbranch-protection=<mode>: - standard or pac-ret: add PACIASP and AUTIASP, also enables BTI (read below) - pac-ret+b-key: add PACIBSP and AUTIBSP Armv8.5-A Branch Target Identification -------------------------------------- Branch Target Identification features some new instructions which protect the execution of instructions on guarded pages which are not intended branch targets. If Armv8.5-A is supported by the hardware, execution of an instruction changes the value of PSTATE.BTYPE field. If an indirect branch lands on a guarded page the target instruction must be one of the BTI <jc> flavors, or in case of a direct call or jump it can be any other instruction. If the target instruction is not compatible with the value of PSTATE.BTYPE a Branch Target Exception is generated. In short, indirect jumps are compatible with BTI <j> and <jc> while indirect calls are compatible with BTI <c> and <jc>. Please refer to the specification for the details. Armv8.3-A PACIASP and PACIBSP are implicit branch target identification instructions which are equivalent with BTI c or BTI jc depending on system register configuration. BTI is used to mitigate JOP (Jump-oriented Programming) attacks by limiting the set of instructions which can be jumped to. BTI requires active linker support to mark the pages with BTI-enabled code as guarded. For ELF64 files BTI compatibility is recorded in the .note.gnu.property section. For a shared object or static binary it is required that all linked units support BTI. This means that even a single assembly file without the required note section turns-off BTI for the whole binary or shared object. The new BTI instructions are treated as NOPs on hardware which does not support Armv8.5-A or on pages which are not guarded. To insert this new and optional instruction compile with -mbranch-protection=standard (also enables PAuth) or +bti. When targeting a guarded page from a non-guarded page, weaker compatibility restrictions apply to maintain compatibility between legacy and new code. For detailed rules please refer to the Arm ARM. Compiler support ---------------- Compiler support requires understanding '-mbranch-protection=<mode>' and emitting the appropriate feature macros (__ARM_FEATURE_BTI_DEFAULT and __ARM_FEATURE_PAC_DEFAULT). The current state is the following: ------------------------------------------------------- | Compiler | -mbranch-protection | Feature macros | +----------+---------------------+--------------------+ | clang | 9.0.0 | 11.0.0 | +----------+---------------------+--------------------+ | gcc | 9 | expected in 10.1+ | ------------------------------------------------------- Available Platforms ------------------ Arm Fast Model and QEMU support both extensions. https://developer.arm.com/tools-and-software/simulation-models/fast-models https://www.qemu.org/ Implementation Notes -------------------- This change adds BTI landing pads even to assembly functions which are likely to be directly called only. In these cases, landing pads might be superfluous depending on what code the linker generates. Code size and performance impact for these cases would be negligible. Interaction with C code ----------------------- Pointer Authentication is a per-frame protection while Branch Target Identification can be turned on and off only for all code pages of a whole shared object or static binary. Because of these properties if C/C++ code is compiled without any of the above features but assembly files support any of them unconditionally there is no incompatibility between the two. Useful Links ------------ To fully understand the details of both PAuth and BTI it is advised to read the related chapters of the Arm Architecture Reference Manual (Arm ARM): https://developer.arm.com/documentation/ddi0487/latest/ Additional materials: "Providing protection for complex software" https://developer.arm.com/architectures/learn-the-architecture/providing-protection-for-complex-software Arm Compiler Reference Guide Version 6.14: -mbranch-protection https://developer.arm.com/documentation/101754/0614/armclang-Reference/armclang-Command-line-Options/-mbranch-protection?lang=en Arm C Language Extensions (ACLE) https://developer.arm.com/docs/101028/latest Addional Notes -------------- This patch is a copy of the work done by Tamas Petz in boringssl. It contains the changes from the following commits: aarch64: support BTI and pointer authentication in assembly Change-Id: I4335f92e2ccc8e209c7d68a0a79f1acdf3aeb791 URL: https://boringssl-review.googlesource.com/c/boringssl/+/42084 aarch64: Improve conditional compilation Change-Id: I14902a64e5f403c2b6a117bc9f5fb1a4f4611ebf URL: https://boringssl-review.googlesource.com/c/boringssl/+/43524 aarch64: Fix name of gnu property note section Change-Id: I6c432d1c852129e9c273f6469a8b60e3983671ec URL: https://boringssl-review.googlesource.com/c/boringssl/+/44024 Change-Id: I2d95ebc5e4aeb5610d3b226f9754ee80cf74a9af Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16674) (cherry picked from commit 19e277dd19f2897f6a7b7eb236abe46655e575bf)
2022-10-13Fix an occasional CI failure due to unaligned accessBernd Edlinger1-4/+14
This happens rarely, but only because very few CI runs use the exotic CPU type that is necessary to execute anything within rsaz_exp_x2.c and enable UBSAN at the same time. crypto/bn/rsaz_exp_x2.c:562:20: runtime error: load of misaligned address 0x612000022cc6 for type 'uint64_t' (aka 'unsigned long'), which requires 8 byte alignment 0x612000022cc6: note: pointer points here 84 a3 78 e0 8e 8d 4a a5 51 9c 57 d0 d6 41 f3 26 d1 4e e1 98 42 b5 3a 9f 04 f1 73 d2 1d bf 73 44 ^ SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior crypto/bn/rsaz_exp_x2.c:562:20 in ../../util/wrap.pl ../../fuzz/server-test ../../fuzz/corpora/server => 1 not ok 2 - Fuzzing server Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19412)
2022-10-11Update copyright yearMatt Caswell3-3/+3
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19382)
2022-10-05Fix LLVM vs Apple LLVM version numbering confusion, for $avx512ifmaRichard Levitte1-2/+11
Apple LLVM has a different version numbering scheme than upstream LLVM. That makes for quite a bit of confusion. https://en.wikipedia.org/wiki/Xcode#Toolchain_versions to the rescue, they have collected quite a lot of useful data. This change is concentrated around the `$avx512ifma` flag Fixes #16670 for OpenSSL 3.0 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19352)
2022-10-04Fix error propagatation in BN_check_prime()Kazuki Yamaguchi1-2/+3
BN_check_prime() is supposed to return 0 for a composite number and -1 on error. Properly translate the return value of the internal function ossl_bn_miller_rabin_is_prime(), where 0 means an error. The confusion prevented BN_GENCB callbacks from aborting the primality test or key generation routines utilizing this. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19314) (cherry picked from commit 0b3867634f74f6cb7b60b3a0adde396421207214)
2022-08-17Fix memory leak in BN_rand_range()valdaarhun1-0/+5
The patch enables BN_rand_range() to exit immediately if BIGNUM *rnd is NULL. CLA: trivial Fixes: #18951 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18982) (cherry picked from commit 70f589ae41928edda18470ba1c3df82af02a92b3)
2022-07-05Update copyright yearRichard Levitte1-1/+1
Reviewed-by: Paul Dale <pauli@openssl.org> Release: yes
2022-07-05Fix bn_gcd code to check return value when calling BN_one()slontis1-2/+4
BN_one() uses the expand function which calls malloc which may fail. All other places that reference BN_one() check the return value. The issue is triggered by a memory allocation failure. Detected by PR #18355 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18697) (cherry picked from commit 7fe7cc57af3db1e497877f0329ba17609b2efc8b)
2022-06-23rsa: fix bn_reduce_once_in_place call for rsaz_mod_exp_avx512_x2Xi Ruoyao1-0/+3
bn_reduce_once_in_place expects the number of BN_ULONG, but factor_size is moduli bit size. Fixes #18625. Signed-off-by: Xi Ruoyao <xry111@xry111.site> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18626) (cherry picked from commit 4d8a88c134df634ba610ff8db1eb8478ac5fd345)
2022-06-21Update copyright yearMatt Caswell6-6/+6
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2022-06-16Add an extra reduction step to RSAZ mod_exp implementationsTomas Mraz3-0/+34
Inspired by BoringSSL fix by David Benjamin. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18510) (cherry picked from commit 6d702cebfce3ffd9d8c0cb2af80a987d3288e7a3)
2022-06-16Always end BN_mod_exp_mont_consttime with normal Montgomery reduction.Tomas Mraz2-214/+26
This partially fixes a bug where, on x86_64, BN_mod_exp_mont_consttime would sometimes return m, the modulus, when it should have returned zero. Thanks to Guido Vranken for reporting it. It is only a partial fix because the same bug also exists in the "rsaz" codepath. The bug only affects zero outputs (with non-zero inputs), so we believe it has no security impact on our cryptographic functions. The fx is to delete lowercase bn_from_montgomery altogether, and have the mont5 path use the same BN_from_montgomery ending as the non-mont5 path. This only impacts the final step of the whole exponentiation and has no measurable perf impact. See the original BoringSSL commit https://boringssl.googlesource.com/boringssl/+/13c9d5c69d04485a7a8840c12185c832026c8315 for further analysis. Original-author: David Benjamin <davidben@google.com> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/18510) (cherry picked from commit 0ae365e1f80648f4c52aa3ac9bbc279b6192b23e)
generated by cgit v1.1 at 2024-07-13 15:32:14 +0000