generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

By adding a BN_CTX parameter to the 'rsa_mod_exp' callback, private key

Browse Source 
operations no longer require two distinct BN_CTX structures. This may put
more "strain" on the current BN_CTX implementation (which has a fixed limit
to the number of variables it will hold), but so far this limit is not
triggered by any of the tests pass and I will be changing BN_CTX in the
near future to avoid this problem anyway.

This also changes the default RSA implementation code to use the BN_CTX in
favour of initialising some of its variables locally in each function.
This commit is contained in:
Geoff Thorpe 2004-03-25 02:52:04 +00:00
parent 2d2a5ba32a
commit 46ef873f0b
9 changed files with 112 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@ -4,6 +4,10 @@
Changes between 0.9.7c and 0.9.8 [xx XXX xxxx] Changes between 0.9.7c and 0.9.8 [xx XXX xxxx]
*) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
to allow all RSA operations to function using a single BN_CTX.
[Geoff Thorpe]
*) Preliminary support for certificate policy evaluation and checking. This *) Preliminary support for certificate policy evaluation and checking. This
is initially intended to pass the tests outlined in "Conformance Testing is initially intended to pass the tests outlined in "Conformance Testing
of Relying Party Client Certificate Path Processing Logic" v1.07. of Relying Party Client Certificate Path Processing Logic" v1.07.

2
crypto/rsa/rsa.h
View File

@ -93,7 +93,7 @@ typedef struct rsa_meth_st
int (*rsa_priv_dec)(int flen,const unsigned char *from, int (*rsa_priv_dec)(int flen,const unsigned char *from,
unsigned char *to, unsigned char *to,
RSA *rsa,int padding); RSA *rsa,int padding);
int (*rsa_mod_exp)(BIGNUM *r0,const BIGNUM *I,RSA *rsa); /* Can be null */ int (*rsa_mod_exp)(BIGNUM *r0,const BIGNUM *I,RSA *rsa,BN_CTX *ctx); /* Can be null */
int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
const BIGNUM *m, BN_CTX *ctx, const BIGNUM *m, BN_CTX *ctx,
BN_MONT_CTX *m_ctx); /* Can be null */ BN_MONT_CTX *m_ctx); /* Can be null */

181
crypto/rsa/rsa_eay.c
View File

@ -72,7 +72,7 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa,int padding); unsigned char *to, RSA *rsa,int padding);
static int RSA_eay_private_decrypt(int flen, const unsigned char *from, static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa,int padding); unsigned char *to, RSA *rsa,int padding);
static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa); static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx);
static int RSA_eay_init(RSA *rsa); static int RSA_eay_init(RSA *rsa);
static int RSA_eay_finish(RSA *rsa); static int RSA_eay_finish(RSA *rsa);
static RSA_METHOD rsa_pkcs1_eay_meth={ static RSA_METHOD rsa_pkcs1_eay_meth={
@ -137,16 +137,18 @@ static int rsa_eay_mont_helper(BN_MONT_CTX **ptr, const BIGNUM *modulus, BN_CTX
static int RSA_eay_public_encrypt(int flen, const unsigned char *from, static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa, int padding) unsigned char *to, RSA *rsa, int padding)
{ {
BIGNUM f,ret; BIGNUM *f,*ret;
int i,j,k,num=0,r= -1; int i,j,k,num=0,r= -1;
unsigned char *buf=NULL; unsigned char *buf=NULL;
BN_CTX *ctx=NULL; BN_CTX *ctx=NULL;
BN_init(&f);
BN_init(&ret);
if ((ctx=BN_CTX_new()) == NULL) goto err; if ((ctx=BN_CTX_new()) == NULL) goto err;
BN_CTX_start(ctx);
f = BN_CTX_get(ctx);
ret = BN_CTX_get(ctx);
num=BN_num_bytes(rsa->n); num=BN_num_bytes(rsa->n);
if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) buf = OPENSSL_malloc(num);
if (!f || !ret || !buf)
{ {
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE); RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE);
goto err; goto err;
@ -174,9 +176,9 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
} }
if (i <= 0) goto err; if (i <= 0) goto err;
if (BN_bin2bn(buf,num,&f) == NULL) goto err; if (BN_bin2bn(buf,num,f) == NULL) goto err;
if (BN_ucmp(&f, rsa->n) >= 0) if (BN_ucmp(f, rsa->n) >= 0)
{ {
/* usually the padding functions would catch this */ /* usually the padding functions would catch this */
RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
@ -185,21 +187,23 @@ static int RSA_eay_public_encrypt(int flen, const unsigned char *from,
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx, if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
rsa->_method_mod_n)) goto err; rsa->_method_mod_n)) goto err;
/* put in leading 0 bytes if the number is less than the /* put in leading 0 bytes if the number is less than the
* length of the modulus */ * length of the modulus */
j=BN_num_bytes(&ret); j=BN_num_bytes(ret);
i=BN_bn2bin(&ret,&(to[num-j])); i=BN_bn2bin(ret,&(to[num-j]));
for (k=0; k<(num-i); k++) for (k=0; k<(num-i); k++)
to[k]=0; to[k]=0;
r=num; r=num;
err: err:
if (ctx != NULL) BN_CTX_free(ctx); if (ctx != NULL)
BN_clear_free(&f); {
BN_clear_free(&ret); BN_CTX_end(ctx);
BN_CTX_free(ctx);
}
if (buf != NULL) if (buf != NULL)
{ {
OPENSSL_cleanse(buf,num); OPENSSL_cleanse(buf,num);
@ -265,19 +269,20 @@ err:
static int RSA_eay_private_encrypt(int flen, const unsigned char *from, static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa, int padding) unsigned char *to, RSA *rsa, int padding)
{ {
BIGNUM f,ret; BIGNUM *f,*ret;
int i,j,k,num=0,r= -1; int i,j,k,num=0,r= -1;
unsigned char *buf=NULL; unsigned char *buf=NULL;
BN_CTX *ctx=NULL; BN_CTX *ctx=NULL;
int local_blinding = 0; int local_blinding = 0;
BN_BLINDING *blinding = NULL; BN_BLINDING *blinding = NULL;
BN_init(&f);
BN_init(&ret);
if ((ctx=BN_CTX_new()) == NULL) goto err; if ((ctx=BN_CTX_new()) == NULL) goto err;
BN_CTX_start(ctx);
f = BN_CTX_get(ctx);
ret = BN_CTX_get(ctx);
num=BN_num_bytes(rsa->n); num=BN_num_bytes(rsa->n);
if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) buf = OPENSSL_malloc(num);
if(!f || !ret || !buf)
{ {
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE); RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE);
goto err; goto err;
@ -298,9 +303,9 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
} }
if (i <= 0) goto err; if (i <= 0) goto err;
if (BN_bin2bn(buf,num,&f) == NULL) goto err; if (BN_bin2bn(buf,num,f) == NULL) goto err;
if (BN_ucmp(&f, rsa->n) >= 0) if (BN_ucmp(f, rsa->n) >= 0)
{ {
/* usually the padding functions would catch this */ /* usually the padding functions would catch this */
RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
@ -339,7 +344,7 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
} }
if (blinding) if (blinding)
if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err; if (!BN_BLINDING_convert(f, blinding, ctx)) goto err;
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
((rsa->p != NULL) && ((rsa->p != NULL) &&
@ -347,29 +352,31 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
(rsa->dmp1 != NULL) && (rsa->dmp1 != NULL) &&
(rsa->dmq1 != NULL) && (rsa->dmq1 != NULL) &&
(rsa->iqmp != NULL)) ) (rsa->iqmp != NULL)) )
{ if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; } { if (!rsa->meth->rsa_mod_exp(ret,f,rsa,ctx)) goto err; }
else else
{ {
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx, if (!rsa->meth->bn_mod_exp(ret,f,rsa->d,rsa->n,ctx,
rsa->_method_mod_n)) goto err; rsa->_method_mod_n)) goto err;
} }
if (blinding) if (blinding)
if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err; if (!BN_BLINDING_invert(ret, blinding, ctx)) goto err;
/* put in leading 0 bytes if the number is less than the /* put in leading 0 bytes if the number is less than the
* length of the modulus */ * length of the modulus */
j=BN_num_bytes(&ret); j=BN_num_bytes(ret);
i=BN_bn2bin(&ret,&(to[num-j])); i=BN_bn2bin(ret,&(to[num-j]));
for (k=0; k<(num-i); k++) for (k=0; k<(num-i); k++)
to[k]=0; to[k]=0;
r=num; r=num;
err: err:
if (ctx != NULL) BN_CTX_free(ctx); if (ctx != NULL)
BN_clear_free(&ret); {
BN_clear_free(&f); BN_CTX_end(ctx);
BN_CTX_free(ctx);
}
if (local_blinding) if (local_blinding)
BN_BLINDING_free(blinding); BN_BLINDING_free(blinding);
if (buf != NULL) if (buf != NULL)
@ -383,7 +390,7 @@ err:
static int RSA_eay_private_decrypt(int flen, const unsigned char *from, static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa, int padding) unsigned char *to, RSA *rsa, int padding)
{ {
BIGNUM f,ret; BIGNUM *f,*ret;
int j,num=0,r= -1; int j,num=0,r= -1;
unsigned char *p; unsigned char *p;
unsigned char *buf=NULL; unsigned char *buf=NULL;
@ -391,14 +398,13 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
int local_blinding = 0; int local_blinding = 0;
BN_BLINDING *blinding = NULL; BN_BLINDING *blinding = NULL;
BN_init(&f); if((ctx = BN_CTX_new()) == NULL) goto err;
BN_init(&ret); BN_CTX_start(ctx);
ctx=BN_CTX_new(); f = BN_CTX_get(ctx);
if (ctx == NULL) goto err; ret = BN_CTX_get(ctx);
num=BN_num_bytes(rsa->n); num=BN_num_bytes(rsa->n);
buf = OPENSSL_malloc(num);
if ((buf=(unsigned char *)OPENSSL_malloc(num)) == NULL) if(!f || !ret || !buf)
{ {
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE); RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE);
goto err; goto err;
@ -413,9 +419,9 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
} }
/* make data into a big number */ /* make data into a big number */
if (BN_bin2bn(from,(int)flen,&f) == NULL) goto err; if (BN_bin2bn(from,(int)flen,f) == NULL) goto err;
if (BN_ucmp(&f, rsa->n) >= 0) if (BN_ucmp(f, rsa->n) >= 0)
{ {
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
goto err; goto err;
@ -453,7 +459,7 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
} }
if (blinding) if (blinding)
if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err; if (!BN_BLINDING_convert(f, blinding, ctx)) goto err;
/* do the decrypt */ /* do the decrypt */
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
@ -462,20 +468,20 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
(rsa->dmp1 != NULL) && (rsa->dmp1 != NULL) &&
(rsa->dmq1 != NULL) && (rsa->dmq1 != NULL) &&
(rsa->iqmp != NULL)) ) (rsa->iqmp != NULL)) )
{ if (!rsa->meth->rsa_mod_exp(&ret,&f,rsa)) goto err; } { if (!rsa->meth->rsa_mod_exp(ret,f,rsa,ctx)) goto err; }
else else
{ {
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx, if (!rsa->meth->bn_mod_exp(ret,f,rsa->d,rsa->n,ctx,
rsa->_method_mod_n)) rsa->_method_mod_n))
goto err; goto err;
} }
if (blinding) if (blinding)
if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err; if (!BN_BLINDING_invert(ret, blinding, ctx)) goto err;
p=buf; p=buf;
j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */ j=BN_bn2bin(ret,p); /* j is only used with no-padding mode */
switch (padding) switch (padding)
{ {
@ -501,9 +507,11 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED); RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
err: err:
if (ctx != NULL) BN_CTX_free(ctx); if (ctx != NULL)
BN_clear_free(&f); {
BN_clear_free(&ret); BN_CTX_end(ctx);
BN_CTX_free(ctx);
}
if (local_blinding) if (local_blinding)
BN_BLINDING_free(blinding); BN_BLINDING_free(blinding);
if (buf != NULL) if (buf != NULL)
@ -518,20 +526,19 @@ err:
static int RSA_eay_public_decrypt(int flen, const unsigned char *from, static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa, int padding) unsigned char *to, RSA *rsa, int padding)
{ {
BIGNUM f,ret; BIGNUM *f,*ret;
int i,num=0,r= -1; int i,num=0,r= -1;
unsigned char *p; unsigned char *p;
unsigned char *buf=NULL; unsigned char *buf=NULL;
BN_CTX *ctx=NULL; BN_CTX *ctx=NULL;
BN_init(&f); if((ctx = BN_CTX_new()) == NULL) goto err;
BN_init(&ret); BN_CTX_start(ctx);
ctx=BN_CTX_new(); f = BN_CTX_get(ctx);
if (ctx == NULL) goto err; ret = BN_CTX_get(ctx);
num=BN_num_bytes(rsa->n); num=BN_num_bytes(rsa->n);
buf=(unsigned char *)OPENSSL_malloc(num); buf = OPENSSL_malloc(num);
if (buf == NULL) if(!f || !ret || !buf)
{ {
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE); RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);
goto err; goto err;
@ -545,9 +552,9 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
goto err; goto err;
} }
if (BN_bin2bn(from,flen,&f) == NULL) goto err; if (BN_bin2bn(from,flen,f) == NULL) goto err;
if (BN_ucmp(&f, rsa->n) >= 0) if (BN_ucmp(f, rsa->n) >= 0)
{ {
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
goto err; goto err;
@ -555,11 +562,11 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->e,rsa->n,ctx, if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,
rsa->_method_mod_n)) goto err; rsa->_method_mod_n)) goto err;
p=buf; p=buf;
i=BN_bn2bin(&ret,p); i=BN_bn2bin(ret,p);
switch (padding) switch (padding)
{ {
@ -577,9 +584,11 @@ static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED); RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);
err: err:
if (ctx != NULL) BN_CTX_free(ctx); if (ctx != NULL)
BN_clear_free(&f); {
BN_clear_free(&ret); BN_CTX_end(ctx);
BN_CTX_free(ctx);
}
if (buf != NULL) if (buf != NULL)
{ {
OPENSSL_cleanse(buf,num); OPENSSL_cleanse(buf,num);
@ -588,37 +597,36 @@ err:
return(r); return(r);
} }
static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
BIGNUM r1,m1,vrfy; BIGNUM *r1,*m1,*vrfy;
int ret=0; int ret=0;
BN_CTX *ctx;
BN_init(&m1); BN_CTX_start(ctx);
BN_init(&r1); r1 = BN_CTX_get(ctx);
BN_init(&vrfy); m1 = BN_CTX_get(ctx);
if ((ctx=BN_CTX_new()) == NULL) goto err; vrfy = BN_CTX_get(ctx);
MONT_HELPER(rsa, ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err); MONT_HELPER(rsa, ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
MONT_HELPER(rsa, ctx, q, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err); MONT_HELPER(rsa, ctx, q, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err);
MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); MONT_HELPER(rsa, ctx, n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err);
if (!BN_mod(&r1,I,rsa->q,ctx)) goto err; if (!BN_mod(r1,I,rsa->q,ctx)) goto err;
if (!rsa->meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx, if (!rsa->meth->bn_mod_exp(m1,r1,rsa->dmq1,rsa->q,ctx,
rsa->_method_mod_q)) goto err; rsa->_method_mod_q)) goto err;
if (!BN_mod(&r1,I,rsa->p,ctx)) goto err; if (!BN_mod(r1,I,rsa->p,ctx)) goto err;
if (!rsa->meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx, if (!rsa->meth->bn_mod_exp(r0,r1,rsa->dmp1,rsa->p,ctx,
rsa->_method_mod_p)) goto err; rsa->_method_mod_p)) goto err;
if (!BN_sub(r0,r0,&m1)) goto err; if (!BN_sub(r0,r0,m1)) goto err;
/* This will help stop the size of r0 increasing, which does /* This will help stop the size of r0 increasing, which does
* affect the multiply if it optimised for a power of 2 size */ * affect the multiply if it optimised for a power of 2 size */
if (BN_get_sign(r0)) if (BN_get_sign(r0))
if (!BN_add(r0,r0,rsa->p)) goto err; if (!BN_add(r0,r0,rsa->p)) goto err;
if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err; if (!BN_mul(r1,r0,rsa->iqmp,ctx)) goto err;
if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err; if (!BN_mod(r0,r1,rsa->p,ctx)) goto err;
/* If p < q it is occasionally possible for the correction of /* If p < q it is occasionally possible for the correction of
* adding 'p' if r0 is negative above to leave the result still * adding 'p' if r0 is negative above to leave the result still
* negative. This can break the private key operations: the following * negative. This can break the private key operations: the following
@ -628,21 +636,21 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
*/ */
if (BN_get_sign(r0)) if (BN_get_sign(r0))
if (!BN_add(r0,r0,rsa->p)) goto err; if (!BN_add(r0,r0,rsa->p)) goto err;
if (!BN_mul(&r1,r0,rsa->q,ctx)) goto err; if (!BN_mul(r1,r0,rsa->q,ctx)) goto err;
if (!BN_add(r0,&r1,&m1)) goto err; if (!BN_add(r0,r1,m1)) goto err;
if (rsa->e && rsa->n) if (rsa->e && rsa->n)
{ {
if (!rsa->meth->bn_mod_exp(&vrfy,r0,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) goto err; if (!rsa->meth->bn_mod_exp(vrfy,r0,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) goto err;
/* If 'I' was greater than (or equal to) rsa->n, the operation /* If 'I' was greater than (or equal to) rsa->n, the operation
* will be equivalent to using 'I mod n'. However, the result of * will be equivalent to using 'I mod n'. However, the result of
* the verify will *always* be less than 'n' so we don't check * the verify will *always* be less than 'n' so we don't check
* for absolute equality, just congruency. */ * for absolute equality, just congruency. */
if (!BN_sub(&vrfy, &vrfy, I)) goto err; if (!BN_sub(vrfy, vrfy, I)) goto err;
if (!BN_mod(&vrfy, &vrfy, rsa->n, ctx)) goto err; if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) goto err;
if (BN_get_sign(&vrfy)) if (BN_get_sign(vrfy))
if (!BN_add(&vrfy, &vrfy, rsa->n)) goto err; if (!BN_add(vrfy, vrfy, rsa->n)) goto err;
if (!BN_is_zero(&vrfy)) if (!BN_is_zero(vrfy))
/* 'I' and 'vrfy' aren't congruent mod n. Don't leak /* 'I' and 'vrfy' aren't congruent mod n. Don't leak
* miscalculated CRT output, just do a raw (slower) * miscalculated CRT output, just do a raw (slower)
* mod_exp and return that instead. */ * mod_exp and return that instead. */
@ -651,10 +659,7 @@ static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
} }
ret=1; ret=1;
err: err:
BN_clear_free(&m1); BN_CTX_end(ctx);
BN_clear_free(&r1);
BN_clear_free(&vrfy);
BN_CTX_free(ctx);
return(ret); return(ret);
} }

12
engines/e_aep.c
View File

@ -106,7 +106,7 @@ static AEP_RV aep_mod_exp_crt(BIGNUM *r,const BIGNUM *a, const BIGNUM *p,
/* RSA stuff */ /* RSA stuff */
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa); static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
#endif #endif
/* This function is aliased to mod_exp (with the mont stuff dropped). */ /* This function is aliased to mod_exp (with the mont stuff dropped). */
@ -745,15 +745,11 @@ static int aep_rand_status(void)
#endif #endif
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
BN_CTX *ctx = NULL;
int to_return = 0; int to_return = 0;
AEP_RV rv = AEP_R_OK; AEP_RV rv = AEP_R_OK;
if ((ctx = BN_CTX_new()) == NULL)
goto err;
if (!aep_dso) if (!aep_dso)
{ {
AEPHKerr(AEPHK_F_AEP_RSA_MOD_EXP,AEPHK_R_NOT_LOADED); AEPHKerr(AEPHK_F_AEP_RSA_MOD_EXP,AEPHK_R_NOT_LOADED);
@ -767,7 +763,7 @@ static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
if (rv == FAIL_TO_SW){ if (rv == FAIL_TO_SW){
const RSA_METHOD *meth = RSA_PKCS1_SSLeay(); const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
to_return = (*meth->rsa_mod_exp)(r0, I, rsa); to_return = (*meth->rsa_mod_exp)(r0, I, rsa, ctx);
goto err; goto err;
} }
else if (rv != AEP_R_OK) else if (rv != AEP_R_OK)
@ -790,8 +786,6 @@ static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
to_return = 1; to_return = 1;
err: err:
if(ctx)
BN_CTX_free(ctx);
return to_return; return to_return;
} }
#endif #endif

9
engines/e_atalla.c
View File

@ -86,7 +86,7 @@ static int atalla_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
/* RSA stuff */ /* RSA stuff */
static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa); static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
#endif #endif
/* This function is aliased to mod_exp (with the mont stuff dropped). */ /* This function is aliased to mod_exp (with the mont stuff dropped). */
static int atalla_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, static int atalla_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
@ -502,9 +502,8 @@ err:
} }
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
BN_CTX *ctx = NULL;
int to_return = 0; int to_return = 0;
if(!atalla_dso) if(!atalla_dso)
@ -512,8 +511,6 @@ static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_NOT_LOADED); ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_NOT_LOADED);
goto err; goto err;
} }
if((ctx = BN_CTX_new()) == NULL)
goto err;
if(!rsa->d || !rsa->n) if(!rsa->d || !rsa->n)
{ {
ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_MISSING_KEY_COMPONENTS); ATALLAerr(ATALLA_F_ATALLA_RSA_MOD_EXP,ATALLA_R_MISSING_KEY_COMPONENTS);
@ -521,8 +518,6 @@ static int atalla_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
} }
to_return = atalla_mod_exp(r0, I, rsa->d, rsa->n, ctx); to_return = atalla_mod_exp(r0, I, rsa->d, rsa->n, ctx);
err: err:
if(ctx)
BN_CTX_free(ctx);
return to_return; return to_return;
} }
#endif #endif

9
engines/e_cswift.c
View File

@ -103,7 +103,7 @@ static int cswift_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
/* RSA stuff */ /* RSA stuff */
static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa); static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
#endif #endif
/* This function is aliased to mod_exp (with the mont stuff dropped). */ /* This function is aliased to mod_exp (with the mont stuff dropped). */
static int cswift_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, static int cswift_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
@ -668,13 +668,10 @@ err:
} }
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
BN_CTX *ctx;
int to_return = 0; int to_return = 0;
if((ctx = BN_CTX_new()) == NULL)
goto err;
if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp) if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
{ {
CSWIFTerr(CSWIFT_F_CSWIFT_RSA_MOD_EXP,CSWIFT_R_MISSING_KEY_COMPONENTS); CSWIFTerr(CSWIFT_F_CSWIFT_RSA_MOD_EXP,CSWIFT_R_MISSING_KEY_COMPONENTS);
@ -683,8 +680,6 @@ static int cswift_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
to_return = cswift_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1, to_return = cswift_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,
rsa->dmq1, rsa->iqmp, ctx); rsa->dmq1, rsa->iqmp, ctx);
err: err:
if(ctx)
BN_CTX_free(ctx);
return to_return; return to_return;
} }
#endif #endif

4
engines/e_ncipher.c
View File

@ -102,7 +102,7 @@ static int hwcrhk_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
/* RSA stuff */ /* RSA stuff */
static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa); static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
#endif #endif
/* This function is aliased to mod_exp (with the mont stuff dropped). */ /* This function is aliased to mod_exp (with the mont stuff dropped). */
static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, static int hwcrhk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
@ -946,7 +946,7 @@ err:
} }
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa) static int hwcrhk_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
char tempbuf[1024]; char tempbuf[1024];
HWCryptoHook_ErrMsgBuf rmsg; HWCryptoHook_ErrMsgBuf rmsg;

4
engines/e_nuron.c
View File

@ -192,9 +192,9 @@ static int nuron_mod_exp(BIGNUM *r,const BIGNUM *a,const BIGNUM *p,
} }
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int nuron_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) static int nuron_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
return nuron_mod_exp(r0,I,rsa->d,rsa->n,NULL); return nuron_mod_exp(r0,I,rsa->d,rsa->n,ctx);
} }
#endif #endif

12
engines/e_ubsec.c
View File

@ -89,7 +89,7 @@ static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
const BIGNUM *q, const BIGNUM *dp, const BIGNUM *q, const BIGNUM *dp,
const BIGNUM *dq, const BIGNUM *qinv, BN_CTX *ctx); const BIGNUM *dq, const BIGNUM *qinv, BN_CTX *ctx);
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa); static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
#endif #endif
static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
@ -590,14 +590,10 @@ static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
} }
#ifndef OPENSSL_NO_RSA #ifndef OPENSSL_NO_RSA
static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa) static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{ {
BN_CTX *ctx;
int to_return = 0; int to_return = 0;
if((ctx = BN_CTX_new()) == NULL)
goto err;
if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp) if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
{ {
UBSECerr(UBSEC_F_UBSEC_RSA_MOD_EXP, UBSEC_R_MISSING_KEY_COMPONENTS); UBSECerr(UBSEC_F_UBSEC_RSA_MOD_EXP, UBSEC_R_MISSING_KEY_COMPONENTS);
@ -612,11 +608,9 @@ static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
* Do in software as hardware failed. * Do in software as hardware failed.
*/ */
const RSA_METHOD *meth = RSA_PKCS1_SSLeay(); const RSA_METHOD *meth = RSA_PKCS1_SSLeay();
to_return = (*meth->rsa_mod_exp)(r0, I, rsa); to_return = (*meth->rsa_mod_exp)(r0, I, rsa, ctx);
} }
err: err:
if(ctx)
BN_CTX_free(ctx);
return to_return; return to_return;
} }
#endif #endif