+71
-8
lines changedFilter options
+71
-8
lines changed Original file line number Diff line number Diff line change
@@ -15,6 +15,7 @@
15 15
#include "bn_local.h"
16 16 17 17
#ifndef OPENSSL_NO_EC2M
18 +
# include <openssl/ec.h>
18 19 19 20
/*
20 21
* Maximum number of iterations before BN_GF2m_mod_solve_quad_arr should
@@ -1140,16 +1141,26 @@ int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
1140 1141
/*
1141 1142
* Convert the bit-string representation of a polynomial ( \sum_{i=0}^n a_i *
1142 1143
* x^i) into an array of integers corresponding to the bits with non-zero
1143 -
* coefficient. Array is terminated with -1. Up to max elements of the array
1144 -
* will be filled. Return value is total number of array elements that would
1145 -
* be filled if array was large enough.
1144 +
* coefficient. The array is intended to be suitable for use with
1145 +
* `BN_GF2m_mod_arr()`, and so the constant term of the polynomial must not be
1146 +
* zero. This translates to a requirement that the input BIGNUM `a` is odd.
1147 +
*
1148 +
* Given sufficient room, the array is terminated with -1. Up to max elements
1149 +
* of the array will be filled.
1150 +
*
1151 +
* The return value is total number of array elements that would be filled if
1152 +
* array was large enough, including the terminating `-1`. It is `0` when `a`
1153 +
* is not odd or the constant term is zero contrary to requirement.
1154 +
*
1155 +
* The return value is also `0` when the leading exponent exceeds
1156 +
* `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against CPU exhaustion attacks,
1146 1157
*/
1147 1158
int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
1148 1159
{
1149 1160
int i, j, k = 0;
1150 1161
BN_ULONG mask;
1151 1162 1152 -
if (BN_is_zero(a))
1163 +
if (!BN_is_odd(a))
1153 1164
return 0;
1154 1165 1155 1166
for (i = a->top - 1; i >= 0; i--) {
@@ -1167,12 +1178,13 @@ int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
1167 1178
}
1168 1179
}
1169 1180 1170 -
if (k < max) {
1181 +
if (k > 0 && p[0] > OPENSSL_ECC_MAX_FIELD_BITS)
1182 +
return 0;
1183 + 1184 +
if (k < max)
1171 1185
p[k] = -1;
1172 -
k++;
1173 -
}
1174 1186 1175 -
return k;
1187 +
return k + 1;
1176 1188
}
1177 1189 1178 1190
/*
@@ -155,6 +155,56 @@ static int field_tests_ecp_mont(void)
155 155
}
156 156 157 157
#ifndef OPENSSL_NO_EC2M
158 +
/* Test that decoding of invalid GF2m field parameters fails. */
159 +
static int ec2m_field_sanity(void)
160 +
{
161 +
int ret = 0;
162 +
BN_CTX *ctx = BN_CTX_new();
163 +
BIGNUM *p, *a, *b;
164 +
EC_GROUP *group1 = NULL, *group2 = NULL, *group3 = NULL;
165 + 166 +
TEST_info("Testing GF2m hardening\n");
167 + 168 +
BN_CTX_start(ctx);
169 +
p = BN_CTX_get(ctx);
170 +
a = BN_CTX_get(ctx);
171 +
if (!TEST_ptr(b = BN_CTX_get(ctx))
172 +
|| !TEST_true(BN_one(a))
173 +
|| !TEST_true(BN_one(b)))
174 +
goto out;
175 + 176 +
/* Even pentanomial value should be rejected */
177 +
if (!TEST_true(BN_set_word(p, 0xf2)))
178 +
goto out;
179 +
if (!TEST_ptr_null(group1 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
180 +
TEST_error("Zero constant term accepted in GF2m polynomial");
181 + 182 +
/* Odd hexanomial should also be rejected */
183 +
if (!TEST_true(BN_set_word(p, 0xf3)))
184 +
goto out;
185 +
if (!TEST_ptr_null(group2 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
186 +
TEST_error("Hexanomial accepted as GF2m polynomial");
187 + 188 +
/* Excessive polynomial degree should also be rejected */
189 +
if (!TEST_true(BN_set_word(p, 0x71))
190 +
|| !TEST_true(BN_set_bit(p, OPENSSL_ECC_MAX_FIELD_BITS + 1)))
191 +
goto out;
192 +
if (!TEST_ptr_null(group3 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
193 +
TEST_error("GF2m polynomial degree > %d accepted",
194 +
OPENSSL_ECC_MAX_FIELD_BITS);
195 + 196 +
ret = group1 == NULL && group2 == NULL && group3 == NULL;
197 + 198 +
out:
199 +
EC_GROUP_free(group1);
200 +
EC_GROUP_free(group2);
201 +
EC_GROUP_free(group3);
202 +
BN_CTX_end(ctx);
203 +
BN_CTX_free(ctx);
204 + 205 +
return ret;
206 +
}
207 + 158 208
/* test EC_GF2m_simple_method directly */
159 209
static int field_tests_ec2_simple(void)
160 210
{
@@ -443,6 +493,7 @@ int setup_tests(void)
443 493
ADD_TEST(field_tests_ecp_simple);
444 494
ADD_TEST(field_tests_ecp_mont);
445 495
#ifndef OPENSSL_NO_EC2M
496 +
ADD_TEST(ec2m_field_sanity);
446 497
ADD_TEST(field_tests_ec2_simple);
447 498
#endif
448 499
ADD_ALL_TESTS(field_tests_default, crv_len);
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4