From: Nikos Mavrogiannopoulos <nmav@redhat.com>
Date: Wed, 13 Nov 2013 09:47:48 +0000 (+0100)
Subject: zeroize ECC secret scalars and points.
X-Git-Tag: gnutls_3_3_0pre0~520^2~82
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4cd22fecf1ff33d64a99d1d2dce4f25e4ae0fc76;p=thirdparty%2Fgnutls.git

zeroize ECC secret scalars and points.
---

diff --git a/lib/fips.c b/lib/fips.c
index fa6543d2a7..8c80c5023e 100644
--- a/lib/fips.c
+++ b/lib/fips.c
@@ -19,7 +19,6 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  *
  */
-
 #include <gnutls_int.h>
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
@@ -29,8 +28,6 @@
 #include <gnutls/fips140.h>
 #include <dlfcn.h>
 
-#define FIPS140_TEST
-
 #ifdef ENABLE_FIPS140
 
 unsigned int _gnutls_fips_mode = FIPS_STATE_POWERON;
diff --git a/lib/fips.h b/lib/fips.h
index 25b3e3c7a4..c94cb07863 100644
--- a/lib/fips.h
+++ b/lib/fips.h
@@ -26,6 +26,9 @@
 #include <gnutls_int.h>
 #include <gnutls/gnutls.h>
 
+/* This must be removed when finished */
+#define FIPS140_TEST
+
 typedef enum {
   FIPS_STATE_POWERON,
   FIPS_STATE_INIT,
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 71f1ba74f9..af18ace869 100644
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -1053,15 +1053,18 @@ inline static size_t max_user_send_size(gnutls_session_t session,
 	return max;
 }
 
-#ifdef ENABLE_FIPS140
-# define zeroize_temp_key(x, size) memset(x, 0, size)
-# define zrelease_temp_mpi_key(mpi) if (*mpi!=NULL) { \
+#define zrelease_mpi_key(mpi) if (*mpi!=NULL) { \
                 _gnutls_mpi_clear(*mpi); \
                 _gnutls_mpi_release(mpi); \
         }
+
+#ifdef ENABLE_FIPS140
+# define zeroize_temp_key(x, size) memset(x, 0, size)
+# define zrelease_temp_mpi_key zrelease_mpi_key
 #else
 # define zeroize_temp_key(x, size)
 # define zrelease_temp_mpi_key(mpi) _gnutls_mpi_release(mpi)
 #endif
 
+
 #endif				/* GNUTLS_INT_H */
diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
index 673495dcf0..032678792e 100644
--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
@@ -54,6 +54,21 @@ static void rnd_func(void *_ctx, unsigned length, uint8_t * data)
 	_gnutls_rnd(GNUTLS_RND_RANDOM, data, length);
 }
 
+static void
+ecc_scalar_zclear (struct ecc_scalar *s)
+{
+        memset(s->p, 0, ecc_size(s->ecc)*sizeof(mp_limb_t));
+        ecc_scalar_clear(s);
+}
+
+static void 
+ecc_point_zclear (struct ecc_point *p)
+{
+        memset(p->p, 0, 2*ecc_size(p->ecc)*sizeof(mp_limb_t));
+        ecc_point_clear(p);
+}
+  
+
 static void
 _dsa_params_to_pubkey(const gnutls_pk_params_st * pk_params,
 		      struct dsa_public_key *pub)
@@ -188,7 +203,7 @@ static int _wrap_nettle_pk_derive(gnutls_pk_algorithm_t algo,
 
 		      ecc_cleanup:
 			ecc_point_clear(&ecc_pub);
-			ecc_scalar_clear(&ecc_priv);
+			ecc_scalar_zclear(&ecc_priv);
 			if (ret < 0)
 				goto cleanup;
 			break;
@@ -388,7 +403,7 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
 						  &sig.s);
 
 			dsa_signature_clear(&sig);
-			ecc_scalar_clear(&priv);
+			ecc_scalar_zclear(&priv);
 
 			if (ret < 0) {
 				gnutls_assert();
@@ -884,7 +899,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
 
 			_gnutls_mpi_sub_ui(t1, params->params[RSA_PRIME2],
 					   1);
-			_gnutls_mpi_release(&t2);
+			zrelease_mpi_key(&t2);
 
 			t2 = _gnutls_mpi_mod(params->params[RSA_PRIV], t1);
 			if (t2 == NULL) {
@@ -905,8 +920,8 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
 			ret = 0;
 
 		      rsa_cleanup:
-			_gnutls_mpi_release(&t1);
-			_gnutls_mpi_release(&t2);
+			zrelease_mpi_key(&t1);
+			zrelease_mpi_key(&t2);
 		}
 
 		break;
@@ -940,7 +955,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
 			ret = 0;
 
 		      dsa_cleanup:
-			_gnutls_mpi_release(&t1);
+			zrelease_mpi_key(&t1);
 		}
 
 		break;
@@ -991,7 +1006,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
 			mpz_init(x1);
 			mpz_init(y1);
 			ecc_point_get(&r, x1, y1);
-			ecc_point_clear(&r);
+			ecc_point_zclear(&r);
 
 			mpz_init(x2);
 			mpz_init(y2);
@@ -1008,7 +1023,7 @@ wrap_nettle_pk_verify_params(gnutls_pk_algorithm_t algo,
 			ret = 0;
 
 		      ecc_cleanup:
-			ecc_scalar_clear(&priv);
+			ecc_scalar_zclear(&priv);
 			ecc_point_clear(&pub);
 		}
 		break;
@@ -1042,7 +1057,7 @@ static int calc_rsa_exp(gnutls_pk_params_st * params)
 	params->params[7] =
 	    _gnutls_mpi_mod(params->params[2] /*d */ , tmp);
 
-	_gnutls_mpi_release(&tmp);
+	zrelease_mpi_key(&tmp);
 
 	if (params->params[7] == NULL || params->params[6] == NULL) {
 		gnutls_assert();
@@ -1071,8 +1086,8 @@ wrap_nettle_pk_fixup(gnutls_pk_algorithm_t algo,
 			   TOMPZ(params->params[RSA_PRIME1]));
 
 		/* calculate exp1 [6] and exp2 [7] */
-		_gnutls_mpi_release(&params->params[RSA_E1]);
-		_gnutls_mpi_release(&params->params[RSA_E2]);
+		zrelease_mpi_key(&params->params[RSA_E1]);
+		zrelease_mpi_key(&params->params[RSA_E2]);
 
 		result = calc_rsa_exp(params);
 		if (result < 0) {
@@ -1133,7 +1148,8 @@ extract_digest_info(const struct rsa_public_key *key,
 
 	return 1;
 
-      cleanup:
+cleanup:
+        memset(em, 0, sizeof(key->size));
 	gnutls_free(em);
 
 	return ret;