generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

RT3066: rewrite RSA padding checks to be slightly more constant time.

Browse Source 
Also tweak s3_cbc.c to use new constant-time methods.
Also fix memory leaks from internal errors in RSA_padding_check_PKCS1_OAEP_mgf1

This patch is based on the original RT submission by Adam Langley <agl@chromium.org>,
as well as code from BoringSSL and OpenSSL.

Reviewed-by: Kurt Roeckx <kurt@openssl.org>
This commit is contained in:
Emilia Kasper
2014-08-28 19:43:49 +02:00
parent 51b7be8d5f
commit 294d1e36c2
8 changed files with 308 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ssl/s3_cbc.c
View File

@@ -94,7 +94,7 @@ int ssl3_cbc_remove_padding(const SSL* s,
/* SSLv3 requires that the padding is minimal. */
good &= constant_time_ge(block_size, padding_length+1);
rec->length -= good & (padding_length+1);
return (int)((good & 1) | (~good & -1));
return constant_time_select_int(good, 1, -1);
}
/* tls1_cbc_remove_padding removes the CBC padding from the decrypted, TLS, CBC
@@ -190,7 +190,7 @@ int tls1_cbc_remove_padding(const SSL* s,
good = constant_time_eq(0xff, good & 0xff);
rec->length -= good & (padding_length+1);
return (int)((good & 1) | (~good & -1));
return constant_time_select_int(good, 1, -1);
}
/* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
@@ -650,7 +650,7 @@ void ssl3_cbc_digest_record(
/* If this is the block containing the end of the
* application data, and we are at the offset for the
* 0x80 value, then overwrite b with 0x80. */
b = (b&~is_past_c) | (0x80&is_past_c);
b = constant_time_select_8(is_past_c, 0x80, b);
/* If this the the block containing the end of the
* application data and we're past the 0x80 value then
* just write zero. */
@@ -666,7 +666,8 @@ void ssl3_cbc_digest_record(
if (j >= md_block_size - md_length_size)
{
/* If this is index_b, write a length byte. */
b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
b = constant_time_select_8(
is_block_b, length_bytes[j-(md_block_size-md_length_size)], b);
}
block[j] = b;
}