[thirdparty/openssl.git] / crypto / bn / bn_blind.c

/*
 * Copyright 1998-2018 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include <openssl/opensslconf.h>
#include "internal/cryptlib.h"
#include "bn_local.h"

#define BN_BLINDING_COUNTER     32

struct bn_blinding_st {
    BIGNUM *A;
    BIGNUM *Ai;
    BIGNUM *e;
    BIGNUM *mod;                /* just a reference */
    CRYPTO_THREAD_ID tid;
    int counter;
    unsigned long flags;
    BN_MONT_CTX *m_ctx;
    int (*bn_mod_exp) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
    CRYPTO_RWLOCK *lock;
};

BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod)
{
    BN_BLINDING *ret = NULL;

    bn_check_top(mod);

    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
        BNerr(BN_F_BN_BLINDING_NEW, ERR_R_MALLOC_FAILURE);
        return NULL;
    }

    ret->lock = CRYPTO_THREAD_lock_new();
    if (ret->lock == NULL) {
        BNerr(BN_F_BN_BLINDING_NEW, ERR_R_MALLOC_FAILURE);
        OPENSSL_free(ret);
        return NULL;
    }

    BN_BLINDING_set_current_thread(ret);

    if (A != NULL) {
        if ((ret->A = BN_dup(A)) == NULL)
            goto err;
    }

    if (Ai != NULL) {
        if ((ret->Ai = BN_dup(Ai)) == NULL)
            goto err;
    }

    /* save a copy of mod in the BN_BLINDING structure */
    if ((ret->mod = BN_dup(mod)) == NULL)
        goto err;

    if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
        BN_set_flags(ret->mod, BN_FLG_CONSTTIME);

    /*
     * Set the counter to the special value -1 to indicate that this is
     * never-used fresh blinding that does not need updating before first
     * use.
     */
    ret->counter = -1;

    return ret;

 err:
    BN_BLINDING_free(ret);
    return NULL;
}

void BN_BLINDING_free(BN_BLINDING *r)
{
    if (r == NULL)
        return;
    BN_free(r->A);
    BN_free(r->Ai);
    BN_free(r->e);
    BN_free(r->mod);
    CRYPTO_THREAD_lock_free(r->lock);
    OPENSSL_free(r);
}

int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
{
    int ret = 0;

    if ((b->A == NULL) || (b->Ai == NULL)) {
        BNerr(BN_F_BN_BLINDING_UPDATE, BN_R_NOT_INITIALIZED);
        goto err;
    }

    if (b->counter == -1)
        b->counter = 0;

    if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&
        !(b->flags & BN_BLINDING_NO_RECREATE)) {
        /* re-create blinding parameters */
        if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
            goto err;
    } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {
        if (b->m_ctx != NULL) {
            if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx)
                || !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx))
                goto err;
        } else {
            if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)
                || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))
                goto err;
        }
    }

    ret = 1;
 err:
    if (b->counter == BN_BLINDING_COUNTER)
        b->counter = 0;
    return ret;
}

int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
{
    return BN_BLINDING_convert_ex(n, NULL, b, ctx);
}

int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
{
    int ret = 1;

    bn_check_top(n);

    if ((b->A == NULL) || (b->Ai == NULL)) {
        BNerr(BN_F_BN_BLINDING_CONVERT_EX, BN_R_NOT_INITIALIZED);
        return 0;
    }

    if (b->counter == -1)
        /* Fresh blinding, doesn't need updating. */
        b->counter = 0;
    else if (!BN_BLINDING_update(b, ctx))
        return 0;

    if (r != NULL && (BN_copy(r, b->Ai) == NULL))
        return 0;

    if (b->m_ctx != NULL)
        ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);
    else
        ret = BN_mod_mul(n, n, b->A, b->mod, ctx);

    return ret;
}

int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
{
    return BN_BLINDING_invert_ex(n, NULL, b, ctx);
}

int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
                          BN_CTX *ctx)
{
    int ret;

    bn_check_top(n);

    if (r == NULL && (r = b->Ai) == NULL) {
        BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);
        return 0;
    }

    if (b->m_ctx != NULL) {
        /* ensure that BN_mod_mul_montgomery takes pre-defined path */
        if (n->dmax >= r->top) {
            size_t i, rtop = r->top, ntop = n->top;
            BN_ULONG mask;

            for (i = 0; i < rtop; i++) {
                mask = (BN_ULONG)0 - ((i - ntop) >> (8 * sizeof(i) - 1));
                n->d[i] &= mask;
            }
            mask = (BN_ULONG)0 - ((rtop - ntop) >> (8 * sizeof(ntop) - 1));
            /* always true, if (rtop >= ntop) n->top = r->top; */
            n->top = (int)(rtop & ~mask) | (ntop & mask);
            n->flags |= (BN_FLG_FIXED_TOP & ~mask);
        }
        ret = BN_mod_mul_montgomery(n, n, r, b->m_ctx, ctx);
    } else {
        ret = BN_mod_mul(n, n, r, b->mod, ctx);
    }

    bn_check_top(n);
    return ret;
}

int BN_BLINDING_is_current_thread(BN_BLINDING *b)
{
    return CRYPTO_THREAD_compare_id(CRYPTO_THREAD_get_current_id(), b->tid);
}

void BN_BLINDING_set_current_thread(BN_BLINDING *b)
{
    b->tid = CRYPTO_THREAD_get_current_id();
}

int BN_BLINDING_lock(BN_BLINDING *b)
{
    return CRYPTO_THREAD_write_lock(b->lock);
}

int BN_BLINDING_unlock(BN_BLINDING *b)
{
    return CRYPTO_THREAD_unlock(b->lock);
}

unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b)
{
    return b->flags;
}

void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags)
{
    b->flags = flags;
}

BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
                                      const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
                                      int (*bn_mod_exp) (BIGNUM *r,
                                                         const BIGNUM *a,
                                                         const BIGNUM *p,
                                                         const BIGNUM *m,
                                                         BN_CTX *ctx,
                                                         BN_MONT_CTX *m_ctx),
                                      BN_MONT_CTX *m_ctx)
{
    int retry_counter = 32;
    BN_BLINDING *ret = NULL;

    if (b == NULL)
        ret = BN_BLINDING_new(NULL, NULL, m);
    else
        ret = b;

    if (ret == NULL)
        goto err;

    if (ret->A == NULL && (ret->A = BN_new()) == NULL)
        goto err;
    if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL)
        goto err;

    if (e != NULL) {
        BN_free(ret->e);
        ret->e = BN_dup(e);
    }
    if (ret->e == NULL)
        goto err;

    if (bn_mod_exp != NULL)
        ret->bn_mod_exp = bn_mod_exp;
    if (m_ctx != NULL)
        ret->m_ctx = m_ctx;

    do {
        int rv;
        if (!BN_priv_rand_range_ex(ret->A, ret->mod, ctx))
            goto err;
        if (int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv))
            break;

        /*
         * this should almost never happen for good RSA keys
         */
        if (!rv)
            goto err;

        if (retry_counter-- == 0) {
            BNerr(BN_F_BN_BLINDING_CREATE_PARAM, BN_R_TOO_MANY_ITERATIONS);
            goto err;
        }
    } while (1);

    if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) {
        if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))
            goto err;
    } else {
        if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx))
            goto err;
    }

    if (ret->m_ctx != NULL) {
        if (!bn_to_mont_fixed_top(ret->Ai, ret->Ai, ret->m_ctx, ctx)
            || !bn_to_mont_fixed_top(ret->A, ret->A, ret->m_ctx, ctx))
            goto err;
    }

    return ret;
 err:
    if (b == NULL) {
        BN_BLINDING_free(ret);
        ret = NULL;
    }

    return ret;
}
Commit	Line	Data
4f22f405	1	/*
c4d3c19b	2	* Copyright 1998-2018 The OpenSSL Project Authors. All Rights Reserved.
800e400d	3	*
367ace68	4	* Licensed under the Apache License 2.0 (the "License"). You may not use
4f22f405 RS	5	* this file except in compliance with the License. You can obtain a copy
	6	* in the file LICENSE in the source distribution or at
	7	* https://www.openssl.org/source/license.html
58964a49 RE	8	*/
58964a49 RE	9
98186eb4	10	#include <openssl/opensslconf.h>
b39fc560	11	#include "internal/cryptlib.h"
706457b7	12	#include "bn_local.h"
58964a49	13
0f113f3e	14	#define BN_BLINDING_COUNTER 32
800e400d	15
0f113f3e MC	16	struct bn_blinding_st {
	17	BIGNUM *A;
	18	BIGNUM *Ai;
	19	BIGNUM *e;
	20	BIGNUM mod; / just a reference */
0b1a07c8	21	CRYPTO_THREAD_ID tid;
0f113f3e MC	22	int counter;
	23	unsigned long flags;
	24	BN_MONT_CTX *m_ctx;
	25	int (bn_mod_exp) (BIGNUM r, const BIGNUM a, const BIGNUM p,
	26	const BIGNUM m, BN_CTX ctx, BN_MONT_CTX *m_ctx);
0b1a07c8	27	CRYPTO_RWLOCK *lock;
0f113f3e	28	};
800e400d NL	29
800e400d NL	30	BN_BLINDING BN_BLINDING_new(const BIGNUM A, const BIGNUM Ai, BIGNUM mod)
0f113f3e MC	31	{
	32	BN_BLINDING *ret = NULL;
	33
	34	bn_check_top(mod);
	35
b51bce94	36	if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) {
0f113f3e	37	BNerr(BN_F_BN_BLINDING_NEW, ERR_R_MALLOC_FAILURE);
0b1a07c8	38	return NULL;
0f113f3e	39	}
0b1a07c8 AG	40
	41	ret->lock = CRYPTO_THREAD_lock_new();
	42	if (ret->lock == NULL) {
	43	BNerr(BN_F_BN_BLINDING_NEW, ERR_R_MALLOC_FAILURE);
	44	OPENSSL_free(ret);
	45	return NULL;
	46	}
	47
	48	BN_BLINDING_set_current_thread(ret);
	49
0f113f3e MC	50	if (A != NULL) {
	51	if ((ret->A = BN_dup(A)) == NULL)
	52	goto err;
	53	}
0b1a07c8	54
0f113f3e MC	55	if (Ai != NULL) {
	56	if ((ret->Ai = BN_dup(Ai)) == NULL)
	57	goto err;
	58	}
	59
	60	/* save a copy of mod in the BN_BLINDING structure */
	61	if ((ret->mod = BN_dup(mod)) == NULL)
	62	goto err;
0b1a07c8	63
0f113f3e MC	64	if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
	65	BN_set_flags(ret->mod, BN_FLG_CONSTTIME);
	66
	67	/*
	68	* Set the counter to the special value -1 to indicate that this is
	69	* never-used fresh blinding that does not need updating before first
	70	* use.
	71	*/
	72	ret->counter = -1;
0b1a07c8 AG	73
	74	return ret;
	75
0f113f3e	76	err:
23a1d5e9	77	BN_BLINDING_free(ret);
0b1a07c8	78	return NULL;
0f113f3e	79	}
58964a49	80
6b691a5c	81	void BN_BLINDING_free(BN_BLINDING *r)
0f113f3e	82	{
e6e9170d RS	83	if (r == NULL)
e6e9170d RS	84	return;
23a1d5e9 RS	85	BN_free(r->A);
	86	BN_free(r->Ai);
	87	BN_free(r->e);
	88	BN_free(r->mod);
0b1a07c8	89	CRYPTO_THREAD_lock_free(r->lock);
0f113f3e MC	90	OPENSSL_free(r);
0f113f3e MC	91	}
58964a49	92
6b691a5c	93	int BN_BLINDING_update(BN_BLINDING b, BN_CTX ctx)
0f113f3e MC	94	{
	95	int ret = 0;
	96
	97	if ((b->A == NULL) \|\| (b->Ai == NULL)) {
	98	BNerr(BN_F_BN_BLINDING_UPDATE, BN_R_NOT_INITIALIZED);
	99	goto err;
	100	}
	101
	102	if (b->counter == -1)
	103	b->counter = 0;
	104
	105	if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&
	106	!(b->flags & BN_BLINDING_NO_RECREATE)) {
	107	/* re-create blinding parameters */
	108	if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
	109	goto err;
	110	} else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {
e02c519c AP	111	if (b->m_ctx != NULL) {
	112	if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx)
	113	\|\| !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx))
	114	goto err;
	115	} else {
	116	if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)
	117	\|\| !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))
	118	goto err;
	119	}
0f113f3e MC	120	}
	121
	122	ret = 1;
	123	err:
	124	if (b->counter == BN_BLINDING_COUNTER)
	125	b->counter = 0;
26a7d938	126	return ret;
0f113f3e	127	}
58964a49	128
6b691a5c	129	int BN_BLINDING_convert(BIGNUM n, BN_BLINDING b, BN_CTX *ctx)
0f113f3e MC	130	{
	131	return BN_BLINDING_convert_ex(n, NULL, b, ctx);
	132	}
800e400d NL	133
800e400d NL	134	int BN_BLINDING_convert_ex(BIGNUM n, BIGNUM r, BN_BLINDING b, BN_CTX ctx)
0f113f3e MC	135	{
0f113f3e MC	136	int ret = 1;
c61f571c	137
0f113f3e	138	bn_check_top(n);
dfeab068	139
0f113f3e MC	140	if ((b->A == NULL) \|\| (b->Ai == NULL)) {
0f113f3e MC	141	BNerr(BN_F_BN_BLINDING_CONVERT_EX, BN_R_NOT_INITIALIZED);
26a7d938	142	return 0;
0f113f3e	143	}
800e400d	144
0f113f3e MC	145	if (b->counter == -1)
	146	/* Fresh blinding, doesn't need updating. */
	147	b->counter = 0;
	148	else if (!BN_BLINDING_update(b, ctx))
26a7d938	149	return 0;
e5641d7f	150
e02c519c AP	151	if (r != NULL && (BN_copy(r, b->Ai) == NULL))
e02c519c AP	152	return 0;
800e400d	153
e02c519c AP	154	if (b->m_ctx != NULL)
	155	ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);
	156	else
	157	ret = BN_mod_mul(n, n, b->A, b->mod, ctx);
0f113f3e MC	158
	159	return ret;
	160	}
58964a49	161
6b691a5c	162	int BN_BLINDING_invert(BIGNUM n, BN_BLINDING b, BN_CTX *ctx)
0f113f3e MC	163	{
	164	return BN_BLINDING_invert_ex(n, NULL, b, ctx);
	165	}
	166
	167	int BN_BLINDING_invert_ex(BIGNUM n, const BIGNUM r, BN_BLINDING *b,
	168	BN_CTX *ctx)
	169	{
	170	int ret;
	171
	172	bn_check_top(n);
	173
e02c519c AP	174	if (r == NULL && (r = b->Ai) == NULL) {
	175	BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);
	176	return 0;
	177	}
	178
	179	if (b->m_ctx != NULL) {
	180	/* ensure that BN_mod_mul_montgomery takes pre-defined path */
	181	if (n->dmax >= r->top) {
	182	size_t i, rtop = r->top, ntop = n->top;
	183	BN_ULONG mask;
	184
	185	for (i = 0; i < rtop; i++) {
	186	mask = (BN_ULONG)0 - ((i - ntop) >> (8 * sizeof(i) - 1));
	187	n->d[i] &= mask;
	188	}
	189	mask = (BN_ULONG)0 - ((rtop - ntop) >> (8 * sizeof(ntop) - 1));
	190	/* always true, if (rtop >= ntop) n->top = r->top; */
	191	n->top = (int)(rtop & ~mask) \| (ntop & mask);
	192	n->flags \|= (BN_FLG_FIXED_TOP & ~mask);
0f113f3e	193	}
e02c519c AP	194	ret = BN_mod_mul_montgomery(n, n, r, b->m_ctx, ctx);
	195	} else {
	196	ret = BN_mod_mul(n, n, r, b->mod, ctx);
0f113f3e MC	197	}
	198
	199	bn_check_top(n);
26a7d938	200	return ret;
0f113f3e	201	}
58964a49	202
0b1a07c8 AG	203	int BN_BLINDING_is_current_thread(BN_BLINDING *b)
	204	{
	205	return CRYPTO_THREAD_compare_id(CRYPTO_THREAD_get_current_id(), b->tid);
	206	}
	207
	208	void BN_BLINDING_set_current_thread(BN_BLINDING *b)
0f113f3e	209	{
0b1a07c8	210	b->tid = CRYPTO_THREAD_get_current_id();
0f113f3e	211	}
800e400d	212
0b1a07c8	213	int BN_BLINDING_lock(BN_BLINDING *b)
0f113f3e	214	{
0b1a07c8	215	return CRYPTO_THREAD_write_lock(b->lock);
0f113f3e	216	}
800e400d	217
0b1a07c8	218	int BN_BLINDING_unlock(BN_BLINDING *b)
0f113f3e	219	{
0b1a07c8	220	return CRYPTO_THREAD_unlock(b->lock);
0f113f3e	221	}
48fc582f	222
800e400d	223	unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b)
0f113f3e MC	224	{
	225	return b->flags;
	226	}
800e400d NL	227
800e400d NL	228	void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags)
0f113f3e MC	229	{
	230	b->flags = flags;
	231	}
800e400d NL	232
800e400d NL	233	BN_BLINDING BN_BLINDING_create_param(BN_BLINDING b,
0f113f3e MC	234	const BIGNUM e, BIGNUM m, BN_CTX *ctx,
	235	int (bn_mod_exp) (BIGNUM r,
	236	const BIGNUM *a,
	237	const BIGNUM *p,
	238	const BIGNUM *m,
	239	BN_CTX *ctx,
	240	BN_MONT_CTX *m_ctx),
	241	BN_MONT_CTX *m_ctx)
800e400d	242	{
0f113f3e MC	243	int retry_counter = 32;
	244	BN_BLINDING *ret = NULL;
	245
	246	if (b == NULL)
	247	ret = BN_BLINDING_new(NULL, NULL, m);
	248	else
	249	ret = b;
	250
	251	if (ret == NULL)
	252	goto err;
	253
	254	if (ret->A == NULL && (ret->A = BN_new()) == NULL)
	255	goto err;
	256	if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL)
	257	goto err;
	258
	259	if (e != NULL) {
23a1d5e9	260	BN_free(ret->e);
0f113f3e MC	261	ret->e = BN_dup(e);
	262	}
	263	if (ret->e == NULL)
	264	goto err;
	265
	266	if (bn_mod_exp != NULL)
	267	ret->bn_mod_exp = bn_mod_exp;
	268	if (m_ctx != NULL)
	269	ret->m_ctx = m_ctx;
	270
	271	do {
	272	int rv;
2934be91	273	if (!BN_priv_rand_range_ex(ret->A, ret->mod, ctx))
0f113f3e	274	goto err;
e02c519c	275	if (int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv))
0f113f3e	276	break;
e02c519c AP	277
	278	/*
	279	* this should almost never happen for good RSA keys
	280	*/
	281	if (!rv)
	282	goto err;
	283
	284	if (retry_counter-- == 0) {
	285	BNerr(BN_F_BN_BLINDING_CREATE_PARAM, BN_R_TOO_MANY_ITERATIONS);
	286	goto err;
	287	}
0f113f3e MC	288	} while (1);
	289
	290	if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) {
e02c519c	291	if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))
0f113f3e MC	292	goto err;
	293	} else {
	294	if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx))
	295	goto err;
	296	}
	297
e02c519c AP	298	if (ret->m_ctx != NULL) {
	299	if (!bn_to_mont_fixed_top(ret->Ai, ret->Ai, ret->m_ctx, ctx)
	300	\|\| !bn_to_mont_fixed_top(ret->A, ret->A, ret->m_ctx, ctx))
	301	goto err;
	302	}
	303
0f113f3e MC	304	return ret;
0f113f3e MC	305	err:
23a1d5e9	306	if (b == NULL) {
0f113f3e MC	307	BN_BLINDING_free(ret);
	308	ret = NULL;
	309	}
	310
	311	return ret;
800e400d	312	}