zeroize ECC secret scalars and points.

diff --git a/lib/fips.c b/lib/fips.c
index fa6543d2a74a3264b757ed94d634a1310409662c..8c80c5023ed07cd7497c3f9d8aaf5f3d79b2aec1 100644 (file)
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -19,7 +19,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  *
  */
-
 #include <gnutls_int.h>
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
@@ -29,8 +28,6 @@
 #include <gnutls/fips140.h>
 #include <dlfcn.h>
 
-#define FIPS140_TEST
-
 #ifdef ENABLE_FIPS140
 
 unsigned int _gnutls_fips_mode = FIPS_STATE_POWERON;

diff --git a/lib/fips.h b/lib/fips.h
index 25b3e3c7a467fa5d32a20c3e15d72727e67665a1..c94cb078634b657aeb05317c64dcfec27b843a58 100644 (file)
--- a/lib/fips.h
+++ b/lib/fips.h
@@ -26,6 +26,9 @@
 #include <gnutls_int.h>
 #include <gnutls/gnutls.h>
 
+/* This must be removed when finished */
+#define FIPS140_TEST
+
 typedef enum {
   FIPS_STATE_POWERON,
   FIPS_STATE_INIT,

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 71f1ba74f9398249d03b5c6d712e6a4f1d052229..af18ace86903b3e5274201a8ddc1e5d6ec430095 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -1053,15 +1053,18 @@ inline static size_t max_user_send_size(gnutls_session_t session,
        return max;
 }
 
-#ifdef ENABLE_FIPS140
-# define zeroize_temp_key(x, size) memset(x, 0, size)
-# define zrelease_temp_mpi_key(mpi) if (*mpi!=NULL) { \
+#define zrelease_mpi_key(mpi) if (*mpi!=NULL) { \
                 _gnutls_mpi_clear(*mpi); \
                 _gnutls_mpi_release(mpi); \
         }
+
+#ifdef ENABLE_FIPS140
+# define zeroize_temp_key(x, size) memset(x, 0, size)
+# define zrelease_temp_mpi_key zrelease_mpi_key
 #else
 # define zeroize_temp_key(x, size)
 # define zrelease_temp_mpi_key(mpi) _gnutls_mpi_release(mpi)
 #endif
 
+
 #endif                         /* GNUTLS_INT_H */

diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 673495dcf03c8f09b7fa00816c4df3a312a975e6..032678792e235389fce3199e4980bf9a455a7237 100644 (file)
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -54,6 +54,21 @@ static void rnd_func(void *_ctx, unsigned length, uint8_t * data)
        _gnutls_rnd(GNUTLS_RND_RANDOM, data, length);
 }
 
+static void
+ecc_scalar_zclear (struct ecc_scalar *s)
+{
+        memset(s->p, 0, ecc_size(s->ecc)*sizeof(mp_limb_t));
+        ecc_scalar_clear(s);
+}
+
+static void 
+ecc_point_zclear (struct ecc_point *p)
+{
+        memset(p->p, 0, 2*ecc_size(p->ecc)*sizeof(mp_limb_t));
+        ecc_point_clear(p);
+}
+  
+
 static void
 _dsa_params_to_pubkey(const gnutls_pk_params_st * pk_params,
                      struct dsa_public_key *pub)
@@ -188,7 +203,7 @@ static int _wrap_nettle_pk_derive(gnutls_pk_algorithm_t algo,
 
                      ecc_cleanup:
                        ecc_point_clear(&ecc_pub);
-                       ecc_scalar_clear(&ecc_priv);
+                       ecc_scalar_zclear(&ecc_priv);
                        if (ret < 0)
                                goto cleanup;
                        break;
@@ -388,7 +403,7 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
                                                  &sig.s);
 
                        dsa_signature_clear(&sig);
-                       ecc_scalar_clear(&priv);
+                       ecc_scalar_zclear(&priv);
 
                        if (ret < 0) {
                                gnutls_assert();
@@ -884,7 +899,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
 
                        _gnutls_mpi_sub_ui(t1, params->params[RSA_PRIME2],
                                           1);
-                       _gnutls_mpi_release(&t2);
+                       zrelease_mpi_key(&t2);
 
                        t2 = _gnutls_mpi_mod(params->params[RSA_PRIV], t1);
                        if (t2 == NULL) {
@@ -905,8 +920,8 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
                        ret = 0;
 
                      rsa_cleanup:
-                       _gnutls_mpi_release(&t1);
-                       _gnutls_mpi_release(&t2);
+                       zrelease_mpi_key(&t1);
+                       zrelease_mpi_key(&t2);
                }
 
                break;
@@ -940,7 +955,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
                        ret = 0;
 
                      dsa_cleanup:
-                       _gnutls_mpi_release(&t1);
+                       zrelease_mpi_key(&t1);
                }
 
                break;
@@ -991,7 +1006,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
                        mpz_init(x1);
                        mpz_init(y1);
                        ecc_point_get(&r, x1, y1);
-                       ecc_point_clear(&r);
+                       ecc_point_zclear(&r);
 
                        mpz_init(x2);
                        mpz_init(y2);
@@ -1008,7 +1023,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
                        ret = 0;
 
                      ecc_cleanup:
-                       ecc_scalar_clear(&priv);
+                       ecc_scalar_zclear(&priv);
                        ecc_point_clear(&pub);
                }
                break;
@@ -1042,7 +1057,7 @@ static int calc_rsa_exp(gnutls_pk_params_st * params)
        params->params[7] =
            _gnutls_mpi_mod(params->params[2] /*d */ , tmp);
 
-       _gnutls_mpi_release(&tmp);
+       zrelease_mpi_key(&tmp);
 
        if (params->params[7] == NULL || params->params[6] == NULL) {
                gnutls_assert();
@@ -1071,8 +1086,8 @@ wrap_nettle_pk_fixup(gnutls_pk_algorithm_t algo,
                           TOMPZ(params->params[RSA_PRIME1]));
 
                /* calculate exp1 [6] and exp2 [7] */
-               _gnutls_mpi_release(&params->params[RSA_E1]);
-               _gnutls_mpi_release(&params->params[RSA_E2]);
+               zrelease_mpi_key(&params->params[RSA_E1]);
+               zrelease_mpi_key(&params->params[RSA_E2]);
 
                result = calc_rsa_exp(params);
                if (result < 0) {
@@ -1133,7 +1148,8 @@ extract_digest_info(const struct rsa_public_key *key,
 
        return 1;
 
-      cleanup:
+cleanup:
+        memset(em, 0, sizeof(key->size));
        gnutls_free(em);
 
        return ret;