The branch master has been updated via 677c4a012a7e72b5f2dd239639034f01fad850bf (commit) via 6376c229c44a355248db17e9f0bb2e4567a16d0d (commit) via 58738b1cad8777230226009a6bb4efa3def22216 (commit) from 826112295ae94e5b15fe5073cfdf4cff6d79503b (commit)
- Log ----------------------------------------------------------------- commit 677c4a012a7e72b5f2dd239639034f01fad850bf Author: Patrick Steuer <patrick.ste...@de.ibm.com> Date: Sun Nov 3 00:32:04 2019 +0100 s390x assembly pack: process x25519 and x448 non-canonical values ...in constant time. Signed-off-by: Patrick Steuer <patrick.ste...@de.ibm.com> Reviewed-by: Matt Caswell <m...@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10339) commit 6376c229c44a355248db17e9f0bb2e4567a16d0d Author: Patrick Steuer <patrick.ste...@de.ibm.com> Date: Sun Nov 3 00:01:20 2019 +0100 Add self-generated test vector for x448 non-canonical values x25519 has such a test vector obtained from wycheproof but wycheproof does not have a corresponding x448 test vector. So add a self-generated test vector for that case. Signed-off-by: Patrick Steuer <patrick.ste...@de.ibm.com> Reviewed-by: Matt Caswell <m...@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10339) commit 58738b1cad8777230226009a6bb4efa3def22216 Author: Patrick Steuer <patrick.ste...@de.ibm.com> Date: Sat Nov 2 23:50:26 2019 +0100 s390x assembly pack: fix x448 handling of non-canonical values The s390x x448 implementation does not correctly reduce non-canonical values i.e., u-coordinates >= p = 2^448 - 2^224 - 1. Signed-off-by: Patrick Steuer <patrick.ste...@de.ibm.com> Reviewed-by: Matt Caswell <m...@openssl.org> (Merged from https://github.com/openssl/openssl/pull/10339) ----------------------------------------------------------------------- Summary of changes: crypto/ec/ecx_meth.c | 21 ++++++++++----------- include/internal/constant_time.h | 28 ++++++++++++++++++++++++++++ test/recipes/30-test_evp_data/evppkey.txt | 7 +++++++ 3 files changed, 45 insertions(+), 11 deletions(-) diff --git a/crypto/ec/ecx_meth.c b/crypto/ec/ecx_meth.c index eace1a88cd..d141fe7b81 100644 --- a/crypto/ec/ecx_meth.c +++ b/crypto/ec/ecx_meth.c @@ -854,6 +854,7 @@ static const EVP_PKEY_METHOD ed448_pkey_meth = { #ifdef S390X_EC_ASM # include "s390x_arch.h" +# include "internal/constant_time.h" static void s390x_x25519_mod_p(unsigned char u[32]) { @@ -867,16 +868,16 @@ static void s390x_x25519_mod_p(unsigned char u[32]) u_red[31] = (unsigned char)c; c >>= 8; - for (i = 30; c > 0 && i >= 0; i--) { + for (i = 30; i >= 0; i--) { c += (unsigned int)u_red[i]; u_red[i] = (unsigned char)c; c >>= 8; } - if (u_red[0] & 0x80) { - u_red[0] &= 0x7f; - memcpy(u, u_red, sizeof(u_red)); - } + c = (u_red[0] & 0x80) >> 7; + u_red[0] &= 0x7f; + constant_time_cond_swap_buff(0 - (unsigned char)c, + u, u_red, sizeof(u_red)); } static void s390x_x448_mod_p(unsigned char u[56]) @@ -901,16 +902,14 @@ static void s390x_x448_mod_p(unsigned char u[56]) u_red[27] = (unsigned char)c; c >>= 8; - for (i = 26; c > 0 && i >= 0; i--) { + for (i = 26; i >= 0; i--) { c += (unsigned int)u_red[i]; u_red[i] = (unsigned char)c; c >>= 8; } - if (u_red[0] & 0x80) { - u_red[0] &= 0x7f; - memcpy(u, u_red, sizeof(u_red)); - } + constant_time_cond_swap_buff(0 - (unsigned char)c, + u, u_red, sizeof(u_red)); } static int s390x_x25519_mul(unsigned char u_dst[32], @@ -966,7 +965,7 @@ static int s390x_x448_mul(unsigned char u_dst[56], memcpy(param.x448.d_src, d_src, 56); s390x_flip_endian64(param.x448.u_src, param.x448.u_src); - s390x_x448_mod_p(param.x448.u_src); + s390x_x448_mod_p(param.x448.u_src + 8); s390x_flip_endian64(param.x448.d_src, param.x448.d_src); param.x448.d_src[63] &= 252; diff --git a/include/internal/constant_time.h b/include/internal/constant_time.h index d98dae9545..dc75e31df1 100644 --- a/include/internal/constant_time.h +++ b/include/internal/constant_time.h @@ -352,6 +352,34 @@ static ossl_inline void constant_time_cond_swap_64(uint64_t mask, uint64_t *a, *b ^= xor; } +/* + * mask must be 0xFF or 0x00. + * "constant time" is per len. + * + * if (mask) { + * unsigned char tmp[len]; + * + * memcpy(tmp, a, len); + * memcpy(a, b); + * memcpy(b, tmp); + * } + */ +static ossl_inline void constant_time_cond_swap_buff(unsigned char mask, + unsigned char *a, + unsigned char *b, + size_t len) +{ + size_t i; + unsigned char tmp; + + for (i = 0; i < len; i++) { + tmp = a[i] ^ b[i]; + tmp &= mask; + a[i] ^= tmp; + b[i] ^= tmp; + } +} + /* * table is a two dimensional array of bytes. Each row has rowsize elements. * Copies row number idx into out. rowsize and numrows are not considered diff --git a/test/recipes/30-test_evp_data/evppkey.txt b/test/recipes/30-test_evp_data/evppkey.txt index d395f15664..9b3e514024 100644 --- a/test/recipes/30-test_evp_data/evppkey.txt +++ b/test/recipes/30-test_evp_data/evppkey.txt @@ -807,6 +807,8 @@ PublicKeyRaw=Bob-448-PUBLIC-Raw:X448:3eb7a829b0cd20f5bcfc0b599b6feccf6da4627107b PrivPubKeyPair = Bob-448-Raw:Bob-448-PUBLIC-Raw +PublicKeyRaw=Bob-448-PUBLIC-Raw-NonCanonical:X448:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff + Derive=Alice-448 PeerKey=Bob-448-PUBLIC SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d @@ -823,6 +825,11 @@ Derive=Bob-448-Raw PeerKey=Alice-448-PUBLIC-Raw SharedSecret=07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d +# Self-generated non-canonical +Derive=Alice-448-Raw +PeerKey=Bob-448-PUBLIC-Raw-NonCanonical +SharedSecret=66e2e682b1f8e68c809f1bb3e406bd826921d9c1a5bfbfcbab7ae72feecee63660eabd54934f3382061d17607f581a90bdac917a064959fb + # Illegal sign/verify operations with X448 key Sign=Alice-448