Revert part of 67aae9d2873bb56a7e7028709d2f2d4bd8897955.

* rsa-sec-decrypt.c (rsa_sec_decrypt): Merge with
_rsa_sec_decrypt, including input range check.
(_rsa_sec_decrypt): Deleted.
* rsa-internal.h (_rsa_sec_decrypt): Delete declaration.
* testsuite/rsa-sec-decrypt-test.c (rsa_decrypt_for_test): Always
call rsa_sec_decrypt, but don't annotate the ciphertext input as
undefined/secret.

diff --git a/ChangeLog b/ChangeLog
index 623c60bb3cfe1b2d6305dd52355e329cc167500f..a25b7b5b94366331d51534925c5dc417bec16afb 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2023-11-22  Niels Möller  <nisse@lysator.liu.se>
+
+       Revert part of the 2023-08-05 change.
+       * rsa-sec-decrypt.c (rsa_sec_decrypt): Merge with
+       _rsa_sec_decrypt, including input range check.
+       (_rsa_sec_decrypt): Deleted.
+       * rsa-internal.h (_rsa_sec_decrypt): Delete declaration.
+       * testsuite/rsa-sec-decrypt-test.c (rsa_decrypt_for_test): Always
+       call rsa_sec_decrypt, but don't annotate the ciphertext input as
+       undefined/secret.
+
 2023-11-15  Niels Möller  <nisse@lysator.liu.se>
 
        * ecc-mod-arith.c (ecc_mod_addmul_1): Use assert_maybe.

diff --git a/rsa-internal.h b/rsa-internal.h
index ed4ebe887397e0588b772bd982884fb61b810369..f66a7df049b675ac471d345d56000a2180fc31f6 100644 (file)
--- a/rsa-internal.h
+++ b/rsa-internal.h
@@ -44,7 +44,6 @@
 #define _rsa_sec_compute_root_itch _nettle_rsa_sec_compute_root_itch
 #define _rsa_sec_compute_root _nettle_rsa_sec_compute_root
 #define _rsa_sec_compute_root_tr _nettle_rsa_sec_compute_root_tr
-#define _rsa_sec_decrypt _nettle_rsa_sec_decrypt
 
 /* Internal functions. */
 int
@@ -86,13 +85,4 @@ _rsa_sec_compute_root_tr(const struct rsa_public_key *pub,
                         void *random_ctx, nettle_random_func *random,
                         mp_limb_t *x, const mp_limb_t *m);
 
-/* Variant without range check of the input, to ease testing for
-   side-channel silence. */
-int
-_rsa_sec_decrypt (const struct rsa_public_key *pub,
-                 const struct rsa_private_key *key,
-                 void *random_ctx, nettle_random_func *random,
-                 size_t length, uint8_t *message,
-                 const mpz_t gibberish);
-
 #endif /* NETTLE_RSA_INTERNAL_H_INCLUDED */

diff --git a/rsa-sec-decrypt.c b/rsa-sec-decrypt.c
index e2f953e280f5ff3178876b142e073c4b43a309ea..4c98958dd52863dfc2682dfa60532bd4980f44d8 100644 (file)
--- a/rsa-sec-decrypt.c
+++ b/rsa-sec-decrypt.c
@@ -44,19 +44,21 @@
 
 #include "gmp-glue.h"
 
-/* Variant without range check of the input, to ease testing for
-   side-channel silence. */
 int
-_rsa_sec_decrypt (const struct rsa_public_key *pub,
-                 const struct rsa_private_key *key,
-                 void *random_ctx, nettle_random_func *random,
-                 size_t length, uint8_t *message,
-                 const mpz_t gibberish)
+rsa_sec_decrypt(const struct rsa_public_key *pub,
+               const struct rsa_private_key *key,
+               void *random_ctx, nettle_random_func *random,
+               size_t length, uint8_t *message,
+               const mpz_t gibberish)
 {
   TMP_GMP_DECL (m, mp_limb_t);
   TMP_GMP_DECL (em, uint8_t);
   int res;
 
+  /* First check that input is in range. */
+  if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, pub->n) >= 0)
+    return 0;
+
   TMP_GMP_ALLOC (m, mpz_size(pub->n));
   TMP_GMP_ALLOC (em, key->size);
 
@@ -76,16 +78,3 @@ _rsa_sec_decrypt (const struct rsa_public_key *pub,
   return res;
 }
 
-int
-rsa_sec_decrypt (const struct rsa_public_key *pub,
-                const struct rsa_private_key *key,
-                void *random_ctx, nettle_random_func *random,
-                size_t length, uint8_t *message,
-                const mpz_t gibberish)
-{
-  /* First check that input is in range. */
-  if (mpz_sgn (gibberish) < 0 || mpz_cmp (gibberish, pub->n) >= 0)
-    return 0;
-
-  return _rsa_sec_decrypt (pub, key, random_ctx, random, length, message, gibberish);
-}

diff --git a/testsuite/rsa-sec-decrypt-test.c b/testsuite/rsa-sec-decrypt-test.c
index cc5d49aa74b48e3340e4347632517e82ccdc291a..0b4c7845d13a0503f46539ecc01a6d7f82c690cd 100644 (file)
--- a/testsuite/rsa-sec-decrypt-test.c
+++ b/testsuite/rsa-sec-decrypt-test.c
@@ -1,7 +1,6 @@
 #include "testutils.h"
 
 #include "rsa.h"
-#include "rsa-internal.h"
 #include "knuth-lfib.h"
 
 #define MARK_MPZ_LIMBS_UNDEFINED(x) \
@@ -18,8 +17,6 @@ rsa_decrypt_for_test(const struct rsa_public_key *pub,
                      const mpz_t gibberish)
 {
   int ret;
-  if (!test_side_channel)
-    return rsa_sec_decrypt (pub, key, random_ctx, random, length, message, gibberish);
 
   /* Makes valgrind trigger on any branches depending on the input
      data. Except that (i) we have to allow rsa_sec_compute_root_tr to
@@ -29,7 +26,6 @@ rsa_decrypt_for_test(const struct rsa_public_key *pub,
      mpn_sec_powm may leak information about the least significant
      bits of p and q, due to table lookup in binvert_limb. */
   mark_bytes_undefined (length, message);
-  MARK_MPZ_LIMBS_UNDEFINED(gibberish);
   MARK_MPZ_LIMBS_UNDEFINED(key->a);
   MARK_MPZ_LIMBS_UNDEFINED(key->b);
   MARK_MPZ_LIMBS_UNDEFINED(key->c);
@@ -38,12 +34,10 @@ rsa_decrypt_for_test(const struct rsa_public_key *pub,
   mark_bytes_undefined((mpz_size (key->q) - 3) * sizeof(mp_limb_t), 
                       mpz_limbs_read (key->q) + 1);
 
-  /* Call variant not checking that 0 <= gibberish < n. */
-  ret = _rsa_sec_decrypt (pub, key, random_ctx, random, length, message, gibberish);
+  ret = rsa_sec_decrypt (pub, key, random_ctx, random, length, message, gibberish);
 
   mark_bytes_defined (length, message);
   mark_bytes_defined (sizeof(ret), &ret);
-  MARK_MPZ_LIMBS_DEFINED(gibberish);
   MARK_MPZ_LIMBS_DEFINED(key->a);
   MARK_MPZ_LIMBS_DEFINED(key->b);
   MARK_MPZ_LIMBS_DEFINED(key->c);