]>
Commit | Line | Data |
---|---|---|
4f22f405 | 1 | /* |
da1c088f | 2 | * Copyright 1998-2023 The OpenSSL Project Authors. All Rights Reserved. |
800e400d | 3 | * |
367ace68 | 4 | * Licensed under the Apache License 2.0 (the "License"). You may not use |
4f22f405 RS |
5 | * this file except in compliance with the License. You can obtain a copy |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
58964a49 RE |
8 | */ |
9 | ||
98186eb4 | 10 | #include <openssl/opensslconf.h> |
b39fc560 | 11 | #include "internal/cryptlib.h" |
706457b7 | 12 | #include "bn_local.h" |
58964a49 | 13 | |
0f113f3e | 14 | #define BN_BLINDING_COUNTER 32 |
800e400d | 15 | |
4209ce68 BE |
16 | struct bn_blinding_st { |
17 | BIGNUM *A; | |
18 | BIGNUM *Ai; | |
19 | BIGNUM *e; | |
20 | BIGNUM *mod; /* just a reference */ | |
21 | CRYPTO_THREAD_ID tid; | |
22 | int counter; | |
23 | unsigned long flags; | |
24 | BN_MONT_CTX *m_ctx; | |
25 | int (*bn_mod_exp) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p, | |
26 | const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx); | |
27 | CRYPTO_RWLOCK *lock; | |
28 | }; | |
29 | ||
800e400d | 30 | BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod) |
0f113f3e MC |
31 | { |
32 | BN_BLINDING *ret = NULL; | |
33 | ||
34 | bn_check_top(mod); | |
35 | ||
e077455e | 36 | if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL) |
0b1a07c8 | 37 | return NULL; |
0b1a07c8 AG |
38 | |
39 | ret->lock = CRYPTO_THREAD_lock_new(); | |
40 | if (ret->lock == NULL) { | |
e077455e | 41 | ERR_raise(ERR_LIB_BN, ERR_R_CRYPTO_LIB); |
0b1a07c8 AG |
42 | OPENSSL_free(ret); |
43 | return NULL; | |
44 | } | |
45 | ||
46 | BN_BLINDING_set_current_thread(ret); | |
47 | ||
0f113f3e MC |
48 | if (A != NULL) { |
49 | if ((ret->A = BN_dup(A)) == NULL) | |
50 | goto err; | |
51 | } | |
0b1a07c8 | 52 | |
0f113f3e MC |
53 | if (Ai != NULL) { |
54 | if ((ret->Ai = BN_dup(Ai)) == NULL) | |
55 | goto err; | |
56 | } | |
57 | ||
58 | /* save a copy of mod in the BN_BLINDING structure */ | |
59 | if ((ret->mod = BN_dup(mod)) == NULL) | |
60 | goto err; | |
0b1a07c8 | 61 | |
0f113f3e MC |
62 | if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0) |
63 | BN_set_flags(ret->mod, BN_FLG_CONSTTIME); | |
64 | ||
65 | /* | |
66 | * Set the counter to the special value -1 to indicate that this is | |
67 | * never-used fresh blinding that does not need updating before first | |
68 | * use. | |
69 | */ | |
70 | ret->counter = -1; | |
0b1a07c8 AG |
71 | |
72 | return ret; | |
73 | ||
0f113f3e | 74 | err: |
23a1d5e9 | 75 | BN_BLINDING_free(ret); |
0b1a07c8 | 76 | return NULL; |
0f113f3e | 77 | } |
58964a49 | 78 | |
6b691a5c | 79 | void BN_BLINDING_free(BN_BLINDING *r) |
0f113f3e | 80 | { |
e6e9170d RS |
81 | if (r == NULL) |
82 | return; | |
23a1d5e9 RS |
83 | BN_free(r->A); |
84 | BN_free(r->Ai); | |
85 | BN_free(r->e); | |
86 | BN_free(r->mod); | |
0b1a07c8 | 87 | CRYPTO_THREAD_lock_free(r->lock); |
0f113f3e MC |
88 | OPENSSL_free(r); |
89 | } | |
58964a49 | 90 | |
6b691a5c | 91 | int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx) |
0f113f3e MC |
92 | { |
93 | int ret = 0; | |
94 | ||
95 | if ((b->A == NULL) || (b->Ai == NULL)) { | |
9311d0c4 | 96 | ERR_raise(ERR_LIB_BN, BN_R_NOT_INITIALIZED); |
0f113f3e MC |
97 | goto err; |
98 | } | |
99 | ||
100 | if (b->counter == -1) | |
101 | b->counter = 0; | |
102 | ||
103 | if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL && | |
104 | !(b->flags & BN_BLINDING_NO_RECREATE)) { | |
105 | /* re-create blinding parameters */ | |
106 | if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL)) | |
107 | goto err; | |
108 | } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) { | |
e02c519c AP |
109 | if (b->m_ctx != NULL) { |
110 | if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx) | |
111 | || !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx)) | |
112 | goto err; | |
113 | } else { | |
114 | if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx) | |
115 | || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx)) | |
116 | goto err; | |
117 | } | |
0f113f3e MC |
118 | } |
119 | ||
120 | ret = 1; | |
121 | err: | |
122 | if (b->counter == BN_BLINDING_COUNTER) | |
123 | b->counter = 0; | |
26a7d938 | 124 | return ret; |
0f113f3e | 125 | } |
58964a49 | 126 | |
6b691a5c | 127 | int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) |
0f113f3e MC |
128 | { |
129 | return BN_BLINDING_convert_ex(n, NULL, b, ctx); | |
130 | } | |
800e400d NL |
131 | |
132 | int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx) | |
0f113f3e MC |
133 | { |
134 | int ret = 1; | |
c61f571c | 135 | |
0f113f3e | 136 | bn_check_top(n); |
dfeab068 | 137 | |
0f113f3e | 138 | if ((b->A == NULL) || (b->Ai == NULL)) { |
9311d0c4 | 139 | ERR_raise(ERR_LIB_BN, BN_R_NOT_INITIALIZED); |
26a7d938 | 140 | return 0; |
0f113f3e | 141 | } |
800e400d | 142 | |
0f113f3e MC |
143 | if (b->counter == -1) |
144 | /* Fresh blinding, doesn't need updating. */ | |
145 | b->counter = 0; | |
146 | else if (!BN_BLINDING_update(b, ctx)) | |
26a7d938 | 147 | return 0; |
e5641d7f | 148 | |
e02c519c AP |
149 | if (r != NULL && (BN_copy(r, b->Ai) == NULL)) |
150 | return 0; | |
800e400d | 151 | |
e02c519c AP |
152 | if (b->m_ctx != NULL) |
153 | ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx); | |
154 | else | |
155 | ret = BN_mod_mul(n, n, b->A, b->mod, ctx); | |
0f113f3e MC |
156 | |
157 | return ret; | |
158 | } | |
58964a49 | 159 | |
6b691a5c | 160 | int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) |
0f113f3e MC |
161 | { |
162 | return BN_BLINDING_invert_ex(n, NULL, b, ctx); | |
163 | } | |
164 | ||
165 | int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, | |
166 | BN_CTX *ctx) | |
167 | { | |
168 | int ret; | |
169 | ||
170 | bn_check_top(n); | |
171 | ||
e02c519c | 172 | if (r == NULL && (r = b->Ai) == NULL) { |
9311d0c4 | 173 | ERR_raise(ERR_LIB_BN, BN_R_NOT_INITIALIZED); |
e02c519c AP |
174 | return 0; |
175 | } | |
176 | ||
177 | if (b->m_ctx != NULL) { | |
178 | /* ensure that BN_mod_mul_montgomery takes pre-defined path */ | |
179 | if (n->dmax >= r->top) { | |
180 | size_t i, rtop = r->top, ntop = n->top; | |
181 | BN_ULONG mask; | |
182 | ||
183 | for (i = 0; i < rtop; i++) { | |
184 | mask = (BN_ULONG)0 - ((i - ntop) >> (8 * sizeof(i) - 1)); | |
185 | n->d[i] &= mask; | |
186 | } | |
187 | mask = (BN_ULONG)0 - ((rtop - ntop) >> (8 * sizeof(ntop) - 1)); | |
188 | /* always true, if (rtop >= ntop) n->top = r->top; */ | |
189 | n->top = (int)(rtop & ~mask) | (ntop & mask); | |
190 | n->flags |= (BN_FLG_FIXED_TOP & ~mask); | |
0f113f3e | 191 | } |
f06ef165 BE |
192 | ret = bn_mul_mont_fixed_top(n, n, r, b->m_ctx, ctx); |
193 | bn_correct_top_consttime(n); | |
e02c519c AP |
194 | } else { |
195 | ret = BN_mod_mul(n, n, r, b->mod, ctx); | |
0f113f3e MC |
196 | } |
197 | ||
198 | bn_check_top(n); | |
26a7d938 | 199 | return ret; |
0f113f3e | 200 | } |
58964a49 | 201 | |
0b1a07c8 AG |
202 | int BN_BLINDING_is_current_thread(BN_BLINDING *b) |
203 | { | |
204 | return CRYPTO_THREAD_compare_id(CRYPTO_THREAD_get_current_id(), b->tid); | |
205 | } | |
206 | ||
207 | void BN_BLINDING_set_current_thread(BN_BLINDING *b) | |
0f113f3e | 208 | { |
0b1a07c8 | 209 | b->tid = CRYPTO_THREAD_get_current_id(); |
0f113f3e | 210 | } |
800e400d | 211 | |
0b1a07c8 | 212 | int BN_BLINDING_lock(BN_BLINDING *b) |
0f113f3e | 213 | { |
0b1a07c8 | 214 | return CRYPTO_THREAD_write_lock(b->lock); |
0f113f3e | 215 | } |
800e400d | 216 | |
0b1a07c8 | 217 | int BN_BLINDING_unlock(BN_BLINDING *b) |
0f113f3e | 218 | { |
0b1a07c8 | 219 | return CRYPTO_THREAD_unlock(b->lock); |
0f113f3e | 220 | } |
48fc582f | 221 | |
800e400d | 222 | unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b) |
0f113f3e MC |
223 | { |
224 | return b->flags; | |
225 | } | |
800e400d NL |
226 | |
227 | void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags) | |
0f113f3e MC |
228 | { |
229 | b->flags = flags; | |
230 | } | |
800e400d NL |
231 | |
232 | BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b, | |
0f113f3e MC |
233 | const BIGNUM *e, BIGNUM *m, BN_CTX *ctx, |
234 | int (*bn_mod_exp) (BIGNUM *r, | |
235 | const BIGNUM *a, | |
236 | const BIGNUM *p, | |
237 | const BIGNUM *m, | |
238 | BN_CTX *ctx, | |
239 | BN_MONT_CTX *m_ctx), | |
240 | BN_MONT_CTX *m_ctx) | |
800e400d | 241 | { |
0f113f3e MC |
242 | int retry_counter = 32; |
243 | BN_BLINDING *ret = NULL; | |
244 | ||
245 | if (b == NULL) | |
246 | ret = BN_BLINDING_new(NULL, NULL, m); | |
247 | else | |
248 | ret = b; | |
249 | ||
250 | if (ret == NULL) | |
251 | goto err; | |
252 | ||
253 | if (ret->A == NULL && (ret->A = BN_new()) == NULL) | |
254 | goto err; | |
255 | if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL) | |
256 | goto err; | |
257 | ||
258 | if (e != NULL) { | |
23a1d5e9 | 259 | BN_free(ret->e); |
0f113f3e MC |
260 | ret->e = BN_dup(e); |
261 | } | |
262 | if (ret->e == NULL) | |
263 | goto err; | |
264 | ||
265 | if (bn_mod_exp != NULL) | |
266 | ret->bn_mod_exp = bn_mod_exp; | |
267 | if (m_ctx != NULL) | |
268 | ret->m_ctx = m_ctx; | |
269 | ||
270 | do { | |
271 | int rv; | |
5cbd2ea3 | 272 | if (!BN_priv_rand_range_ex(ret->A, ret->mod, 0, ctx)) |
0f113f3e | 273 | goto err; |
e02c519c | 274 | if (int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv)) |
0f113f3e | 275 | break; |
e02c519c AP |
276 | |
277 | /* | |
278 | * this should almost never happen for good RSA keys | |
279 | */ | |
280 | if (!rv) | |
281 | goto err; | |
282 | ||
283 | if (retry_counter-- == 0) { | |
9311d0c4 | 284 | ERR_raise(ERR_LIB_BN, BN_R_TOO_MANY_ITERATIONS); |
e02c519c AP |
285 | goto err; |
286 | } | |
0f113f3e MC |
287 | } while (1); |
288 | ||
289 | if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) { | |
e02c519c | 290 | if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx)) |
0f113f3e MC |
291 | goto err; |
292 | } else { | |
293 | if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx)) | |
294 | goto err; | |
295 | } | |
296 | ||
e02c519c AP |
297 | if (ret->m_ctx != NULL) { |
298 | if (!bn_to_mont_fixed_top(ret->Ai, ret->Ai, ret->m_ctx, ctx) | |
299 | || !bn_to_mont_fixed_top(ret->A, ret->A, ret->m_ctx, ctx)) | |
300 | goto err; | |
301 | } | |
302 | ||
0f113f3e MC |
303 | return ret; |
304 | err: | |
23a1d5e9 | 305 | if (b == NULL) { |
0f113f3e MC |
306 | BN_BLINDING_free(ret); |
307 | ret = NULL; | |
308 | } | |
309 | ||
310 | return ret; | |
800e400d | 311 | } |