]>
Commit | Line | Data |
---|---|---|
4f22f405 RS |
1 | /* |
2 | * Copyright 1998-2016 The OpenSSL Project Authors. All Rights Reserved. | |
800e400d | 3 | * |
4f22f405 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
58964a49 RE |
8 | */ |
9 | ||
98186eb4 | 10 | #include <openssl/opensslconf.h> |
b39fc560 | 11 | #include "internal/cryptlib.h" |
58964a49 RE |
12 | #include "bn_lcl.h" |
13 | ||
0f113f3e | 14 | #define BN_BLINDING_COUNTER 32 |
800e400d | 15 | |
0f113f3e MC |
16 | struct bn_blinding_st { |
17 | BIGNUM *A; | |
18 | BIGNUM *Ai; | |
19 | BIGNUM *e; | |
20 | BIGNUM *mod; /* just a reference */ | |
0b1a07c8 | 21 | CRYPTO_THREAD_ID tid; |
0f113f3e MC |
22 | int counter; |
23 | unsigned long flags; | |
24 | BN_MONT_CTX *m_ctx; | |
25 | int (*bn_mod_exp) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p, | |
26 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); | |
0b1a07c8 | 27 | CRYPTO_RWLOCK *lock; |
0f113f3e | 28 | }; |
800e400d NL |
29 | |
30 | BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod) | |
0f113f3e MC |
31 | { |
32 | BN_BLINDING *ret = NULL; | |
33 | ||
34 | bn_check_top(mod); | |
35 | ||
b51bce94 | 36 | if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) { |
0f113f3e | 37 | BNerr(BN_F_BN_BLINDING_NEW, ERR_R_MALLOC_FAILURE); |
0b1a07c8 | 38 | return NULL; |
0f113f3e | 39 | } |
0b1a07c8 AG |
40 | |
41 | ret->lock = CRYPTO_THREAD_lock_new(); | |
42 | if (ret->lock == NULL) { | |
43 | BNerr(BN_F_BN_BLINDING_NEW, ERR_R_MALLOC_FAILURE); | |
44 | OPENSSL_free(ret); | |
45 | return NULL; | |
46 | } | |
47 | ||
48 | BN_BLINDING_set_current_thread(ret); | |
49 | ||
0f113f3e MC |
50 | if (A != NULL) { |
51 | if ((ret->A = BN_dup(A)) == NULL) | |
52 | goto err; | |
53 | } | |
0b1a07c8 | 54 | |
0f113f3e MC |
55 | if (Ai != NULL) { |
56 | if ((ret->Ai = BN_dup(Ai)) == NULL) | |
57 | goto err; | |
58 | } | |
59 | ||
60 | /* save a copy of mod in the BN_BLINDING structure */ | |
61 | if ((ret->mod = BN_dup(mod)) == NULL) | |
62 | goto err; | |
0b1a07c8 | 63 | |
0f113f3e MC |
64 | if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0) |
65 | BN_set_flags(ret->mod, BN_FLG_CONSTTIME); | |
66 | ||
67 | /* | |
68 | * Set the counter to the special value -1 to indicate that this is | |
69 | * never-used fresh blinding that does not need updating before first | |
70 | * use. | |
71 | */ | |
72 | ret->counter = -1; | |
0b1a07c8 AG |
73 | |
74 | return ret; | |
75 | ||
0f113f3e | 76 | err: |
23a1d5e9 | 77 | BN_BLINDING_free(ret); |
0b1a07c8 | 78 | return NULL; |
0f113f3e | 79 | } |
58964a49 | 80 | |
6b691a5c | 81 | void BN_BLINDING_free(BN_BLINDING *r) |
0f113f3e | 82 | { |
e6e9170d RS |
83 | if (r == NULL) |
84 | return; | |
23a1d5e9 RS |
85 | BN_free(r->A); |
86 | BN_free(r->Ai); | |
87 | BN_free(r->e); | |
88 | BN_free(r->mod); | |
0b1a07c8 | 89 | CRYPTO_THREAD_lock_free(r->lock); |
0f113f3e MC |
90 | OPENSSL_free(r); |
91 | } | |
58964a49 | 92 | |
6b691a5c | 93 | int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx) |
0f113f3e MC |
94 | { |
95 | int ret = 0; | |
96 | ||
97 | if ((b->A == NULL) || (b->Ai == NULL)) { | |
98 | BNerr(BN_F_BN_BLINDING_UPDATE, BN_R_NOT_INITIALIZED); | |
99 | goto err; | |
100 | } | |
101 | ||
102 | if (b->counter == -1) | |
103 | b->counter = 0; | |
104 | ||
105 | if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL && | |
106 | !(b->flags & BN_BLINDING_NO_RECREATE)) { | |
107 | /* re-create blinding parameters */ | |
108 | if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL)) | |
109 | goto err; | |
110 | } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) { | |
111 | if (!BN_mod_mul(b->A, b->A, b->A, b->mod, ctx)) | |
112 | goto err; | |
113 | if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)) | |
114 | goto err; | |
115 | } | |
116 | ||
117 | ret = 1; | |
118 | err: | |
119 | if (b->counter == BN_BLINDING_COUNTER) | |
120 | b->counter = 0; | |
26a7d938 | 121 | return ret; |
0f113f3e | 122 | } |
58964a49 | 123 | |
6b691a5c | 124 | int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) |
0f113f3e MC |
125 | { |
126 | return BN_BLINDING_convert_ex(n, NULL, b, ctx); | |
127 | } | |
800e400d NL |
128 | |
129 | int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx) | |
0f113f3e MC |
130 | { |
131 | int ret = 1; | |
c61f571c | 132 | |
0f113f3e | 133 | bn_check_top(n); |
dfeab068 | 134 | |
0f113f3e MC |
135 | if ((b->A == NULL) || (b->Ai == NULL)) { |
136 | BNerr(BN_F_BN_BLINDING_CONVERT_EX, BN_R_NOT_INITIALIZED); | |
26a7d938 | 137 | return 0; |
0f113f3e | 138 | } |
800e400d | 139 | |
0f113f3e MC |
140 | if (b->counter == -1) |
141 | /* Fresh blinding, doesn't need updating. */ | |
142 | b->counter = 0; | |
143 | else if (!BN_BLINDING_update(b, ctx)) | |
26a7d938 | 144 | return 0; |
e5641d7f | 145 | |
0f113f3e MC |
146 | if (r != NULL) { |
147 | if (!BN_copy(r, b->Ai)) | |
148 | ret = 0; | |
149 | } | |
800e400d | 150 | |
0f113f3e MC |
151 | if (!BN_mod_mul(n, n, b->A, b->mod, ctx)) |
152 | ret = 0; | |
153 | ||
154 | return ret; | |
155 | } | |
58964a49 | 156 | |
6b691a5c | 157 | int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) |
0f113f3e MC |
158 | { |
159 | return BN_BLINDING_invert_ex(n, NULL, b, ctx); | |
160 | } | |
161 | ||
162 | int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, | |
163 | BN_CTX *ctx) | |
164 | { | |
165 | int ret; | |
166 | ||
167 | bn_check_top(n); | |
168 | ||
169 | if (r != NULL) | |
170 | ret = BN_mod_mul(n, n, r, b->mod, ctx); | |
171 | else { | |
172 | if (b->Ai == NULL) { | |
173 | BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED); | |
26a7d938 | 174 | return 0; |
0f113f3e MC |
175 | } |
176 | ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx); | |
177 | } | |
178 | ||
179 | bn_check_top(n); | |
26a7d938 | 180 | return ret; |
0f113f3e | 181 | } |
58964a49 | 182 | |
0b1a07c8 AG |
183 | int BN_BLINDING_is_current_thread(BN_BLINDING *b) |
184 | { | |
185 | return CRYPTO_THREAD_compare_id(CRYPTO_THREAD_get_current_id(), b->tid); | |
186 | } | |
187 | ||
188 | void BN_BLINDING_set_current_thread(BN_BLINDING *b) | |
0f113f3e | 189 | { |
0b1a07c8 | 190 | b->tid = CRYPTO_THREAD_get_current_id(); |
0f113f3e | 191 | } |
800e400d | 192 | |
0b1a07c8 | 193 | int BN_BLINDING_lock(BN_BLINDING *b) |
0f113f3e | 194 | { |
0b1a07c8 | 195 | return CRYPTO_THREAD_write_lock(b->lock); |
0f113f3e | 196 | } |
800e400d | 197 | |
0b1a07c8 | 198 | int BN_BLINDING_unlock(BN_BLINDING *b) |
0f113f3e | 199 | { |
0b1a07c8 | 200 | return CRYPTO_THREAD_unlock(b->lock); |
0f113f3e | 201 | } |
48fc582f | 202 | |
800e400d | 203 | unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b) |
0f113f3e MC |
204 | { |
205 | return b->flags; | |
206 | } | |
800e400d NL |
207 | |
208 | void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags) | |
0f113f3e MC |
209 | { |
210 | b->flags = flags; | |
211 | } | |
800e400d NL |
212 | |
213 | BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b, | |
0f113f3e MC |
214 | const BIGNUM *e, BIGNUM *m, BN_CTX *ctx, |
215 | int (*bn_mod_exp) (BIGNUM *r, | |
216 | const BIGNUM *a, | |
217 | const BIGNUM *p, | |
218 | const BIGNUM *m, | |
219 | BN_CTX *ctx, | |
220 | BN_MONT_CTX *m_ctx), | |
221 | BN_MONT_CTX *m_ctx) | |
800e400d | 222 | { |
0f113f3e MC |
223 | int retry_counter = 32; |
224 | BN_BLINDING *ret = NULL; | |
225 | ||
226 | if (b == NULL) | |
227 | ret = BN_BLINDING_new(NULL, NULL, m); | |
228 | else | |
229 | ret = b; | |
230 | ||
231 | if (ret == NULL) | |
232 | goto err; | |
233 | ||
234 | if (ret->A == NULL && (ret->A = BN_new()) == NULL) | |
235 | goto err; | |
236 | if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL) | |
237 | goto err; | |
238 | ||
239 | if (e != NULL) { | |
23a1d5e9 | 240 | BN_free(ret->e); |
0f113f3e MC |
241 | ret->e = BN_dup(e); |
242 | } | |
243 | if (ret->e == NULL) | |
244 | goto err; | |
245 | ||
246 | if (bn_mod_exp != NULL) | |
247 | ret->bn_mod_exp = bn_mod_exp; | |
248 | if (m_ctx != NULL) | |
249 | ret->m_ctx = m_ctx; | |
250 | ||
251 | do { | |
252 | int rv; | |
4cffafe9 | 253 | if (!BN_priv_rand_range(ret->A, ret->mod)) |
0f113f3e MC |
254 | goto err; |
255 | if (!int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv)) { | |
256 | /* | |
257 | * this should almost never happen for good RSA keys | |
258 | */ | |
259 | if (rv) { | |
260 | if (retry_counter-- == 0) { | |
261 | BNerr(BN_F_BN_BLINDING_CREATE_PARAM, | |
262 | BN_R_TOO_MANY_ITERATIONS); | |
263 | goto err; | |
264 | } | |
265 | } else | |
266 | goto err; | |
267 | } else | |
268 | break; | |
269 | } while (1); | |
270 | ||
271 | if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) { | |
272 | if (!ret->bn_mod_exp | |
273 | (ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx)) | |
274 | goto err; | |
275 | } else { | |
276 | if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx)) | |
277 | goto err; | |
278 | } | |
279 | ||
280 | return ret; | |
281 | err: | |
23a1d5e9 | 282 | if (b == NULL) { |
0f113f3e MC |
283 | BN_BLINDING_free(ret); |
284 | ret = NULL; | |
285 | } | |
286 | ||
287 | return ret; | |
800e400d | 288 | } |