| Brad Bishop | 220d553 | 2018-08-14 00:59:39 +0100 | [diff] [blame] | 1 | From 9010d1576e278a4274ad3f4aa15776c28f6ba965 Mon Sep 17 00:00:00 2001 |
| 2 | From: NIIBE Yutaka <gniibe@fsij.org> |
| 3 | Date: Wed, 13 Jun 2018 15:28:58 +0900 |
| 4 | Subject: [PATCH] ecc: Add blinding for ECDSA. |
| 5 | |
| 6 | * cipher/ecc-ecdsa.c (_gcry_ecc_ecdsa_sign): Blind secret D with |
| 7 | randomized nonce B. |
| 8 | |
| 9 | -- |
| 10 | |
| 11 | Reported-by: Keegan Ryan <Keegan.Ryan@nccgroup.trust> |
| 12 | CVE-id: CVE-2018-0495 |
| 13 | |
| 14 | Upstream-Status: Backport [http://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965] |
| 15 | |
| 16 | Signed-off-by: NIIBE Yutaka <gniibe@fsij.org> |
| 17 | Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> |
| 18 | --- |
| 19 | cipher/ecc-ecdsa.c | 20 ++++++++++++++++++-- |
| 20 | 1 file changed, 18 insertions(+), 2 deletions(-) |
| 21 | |
| 22 | diff --git a/cipher/ecc-ecdsa.c b/cipher/ecc-ecdsa.c |
| 23 | index 1484830b..140e8c09 100644 |
| 24 | --- a/cipher/ecc-ecdsa.c |
| 25 | +++ b/cipher/ecc-ecdsa.c |
| 26 | @@ -50,6 +50,8 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input, ECC_secret_key *skey, |
| 27 | const void *abuf; |
| 28 | unsigned int abits, qbits; |
| 29 | mpi_ec_t ctx; |
| 30 | + gcry_mpi_t b; /* Random number needed for blinding. */ |
| 31 | + gcry_mpi_t bi; /* multiplicative inverse of B. */ |
| 32 | |
| 33 | if (DBG_CIPHER) |
| 34 | log_mpidump ("ecdsa sign hash ", input ); |
| 35 | @@ -61,6 +63,15 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input, ECC_secret_key *skey, |
| 36 | if (rc) |
| 37 | return rc; |
| 38 | |
| 39 | + b = mpi_snew (qbits); |
| 40 | + bi = mpi_snew (qbits); |
| 41 | + do |
| 42 | + { |
| 43 | + _gcry_mpi_randomize (b, qbits, GCRY_WEAK_RANDOM); |
| 44 | + mpi_mod (b, b, skey->E.n); |
| 45 | + } |
| 46 | + while (!mpi_invm (bi, b, skey->E.n)); |
| 47 | + |
| 48 | k = NULL; |
| 49 | dr = mpi_alloc (0); |
| 50 | sum = mpi_alloc (0); |
| 51 | @@ -115,8 +126,11 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input, ECC_secret_key *skey, |
| 52 | } |
| 53 | while (!mpi_cmp_ui (r, 0)); |
| 54 | |
| 55 | - mpi_mulm (dr, skey->d, r, skey->E.n); /* dr = d*r mod n */ |
| 56 | - mpi_addm (sum, hash, dr, skey->E.n); /* sum = hash + (d*r) mod n */ |
| 57 | + mpi_mulm (dr, b, skey->d, skey->E.n); |
| 58 | + mpi_mulm (dr, dr, r, skey->E.n); /* dr = d*r mod n (blinded with b) */ |
| 59 | + mpi_mulm (sum, b, hash, skey->E.n); |
| 60 | + mpi_addm (sum, sum, dr, skey->E.n); /* sum = hash + (d*r) mod n (blinded with b) */ |
| 61 | + mpi_mulm (sum, bi, sum, skey->E.n); /* undo blinding by b^-1 */ |
| 62 | mpi_invm (k_1, k, skey->E.n); /* k_1 = k^(-1) mod n */ |
| 63 | mpi_mulm (s, k_1, sum, skey->E.n); /* s = k^(-1)*(hash+(d*r)) mod n */ |
| 64 | } |
| 65 | @@ -129,6 +143,8 @@ _gcry_ecc_ecdsa_sign (gcry_mpi_t input, ECC_secret_key *skey, |
| 66 | } |
| 67 | |
| 68 | leave: |
| 69 | + mpi_free (b); |
| 70 | + mpi_free (bi); |
| 71 | _gcry_mpi_ec_free (ctx); |
| 72 | point_free (&I); |
| 73 | mpi_free (x); |
| 74 | -- |
| 75 | 2.13.3 |
| 76 | |