+71
-8
lines changedFilter options
+71
-8
lines changed Original file line number Diff line number Diff line change
@@ -15,6 +15,7 @@
15 15
#include "bn_local.h"
16 16 17 17
#ifndef OPENSSL_NO_EC2M
18 +
# include <openssl/ec.h>
18 19 19 20
/*
20 21
* Maximum number of iterations before BN_GF2m_mod_solve_quad_arr should
@@ -1130,16 +1131,26 @@ int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
1130 1131
/*
1131 1132
* Convert the bit-string representation of a polynomial ( \sum_{i=0}^n a_i *
1132 1133
* x^i) into an array of integers corresponding to the bits with non-zero
1133 -
* coefficient. Array is terminated with -1. Up to max elements of the array
1134 -
* will be filled. Return value is total number of array elements that would
1135 -
* be filled if array was large enough.
1134 +
* coefficient. The array is intended to be suitable for use with
1135 +
* `BN_GF2m_mod_arr()`, and so the constant term of the polynomial must not be
1136 +
* zero. This translates to a requirement that the input BIGNUM `a` is odd.
1137 +
*
1138 +
* Given sufficient room, the array is terminated with -1. Up to max elements
1139 +
* of the array will be filled.
1140 +
*
1141 +
* The return value is total number of array elements that would be filled if
1142 +
* array was large enough, including the terminating `-1`. It is `0` when `a`
1143 +
* is not odd or the constant term is zero contrary to requirement.
1144 +
*
1145 +
* The return value is also `0` when the leading exponent exceeds
1146 +
* `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against CPU exhaustion attacks,
1136 1147
*/
1137 1148
int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
1138 1149
{
1139 1150
int i, j, k = 0;
1140 1151
BN_ULONG mask;
1141 1152 1142 -
if (BN_is_zero(a))
1153 +
if (!BN_is_odd(a))
1143 1154
return 0;
1144 1155 1145 1156
for (i = a->top - 1; i >= 0; i--) {
@@ -1157,12 +1168,13 @@ int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
1157 1168
}
1158 1169
}
1159 1170 1160 -
if (k < max) {
1171 +
if (k > 0 && p[0] > OPENSSL_ECC_MAX_FIELD_BITS)
1172 +
return 0;
1173 + 1174 +
if (k < max)
1161 1175
p[k] = -1;
1162 -
k++;
1163 -
}
1164 1176 1165 -
return k;
1177 +
return k + 1;
1166 1178
}
1167 1179 1168 1180
/*
@@ -155,6 +155,56 @@ static int field_tests_ecp_mont(void)
155 155
}
156 156 157 157
#ifndef OPENSSL_NO_EC2M
158 +
/* Test that decoding of invalid GF2m field parameters fails. */
159 +
static int ec2m_field_sanity(void)
160 +
{
161 +
int ret = 0;
162 +
BN_CTX *ctx = BN_CTX_new();
163 +
BIGNUM *p, *a, *b;
164 +
EC_GROUP *group1 = NULL, *group2 = NULL, *group3 = NULL;
165 + 166 +
TEST_info("Testing GF2m hardening\n");
167 + 168 +
BN_CTX_start(ctx);
169 +
p = BN_CTX_get(ctx);
170 +
a = BN_CTX_get(ctx);
171 +
if (!TEST_ptr(b = BN_CTX_get(ctx))
172 +
|| !TEST_true(BN_one(a))
173 +
|| !TEST_true(BN_one(b)))
174 +
goto out;
175 + 176 +
/* Even pentanomial value should be rejected */
177 +
if (!TEST_true(BN_set_word(p, 0xf2)))
178 +
goto out;
179 +
if (!TEST_ptr_null(group1 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
180 +
TEST_error("Zero constant term accepted in GF2m polynomial");
181 + 182 +
/* Odd hexanomial should also be rejected */
183 +
if (!TEST_true(BN_set_word(p, 0xf3)))
184 +
goto out;
185 +
if (!TEST_ptr_null(group2 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
186 +
TEST_error("Hexanomial accepted as GF2m polynomial");
187 + 188 +
/* Excessive polynomial degree should also be rejected */
189 +
if (!TEST_true(BN_set_word(p, 0x71))
190 +
|| !TEST_true(BN_set_bit(p, OPENSSL_ECC_MAX_FIELD_BITS + 1)))
191 +
goto out;
192 +
if (!TEST_ptr_null(group3 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
193 +
TEST_error("GF2m polynomial degree > %d accepted",
194 +
OPENSSL_ECC_MAX_FIELD_BITS);
195 + 196 +
ret = group1 == NULL && group2 == NULL && group3 == NULL;
197 + 198 +
out:
199 +
EC_GROUP_free(group1);
200 +
EC_GROUP_free(group2);
201 +
EC_GROUP_free(group3);
202 +
BN_CTX_end(ctx);
203 +
BN_CTX_free(ctx);
204 + 205 +
return ret;
206 +
}
207 + 158 208
/* test EC_GF2m_simple_method directly */
159 209
static int field_tests_ec2_simple(void)
160 210
{
@@ -443,6 +493,7 @@ int setup_tests(void)
443 493
ADD_TEST(field_tests_ecp_simple);
444 494
ADD_TEST(field_tests_ecp_mont);
445 495
#ifndef OPENSSL_NO_EC2M
496 +
ADD_TEST(ec2m_field_sanity);
446 497
ADD_TEST(field_tests_ec2_simple);
447 498
#endif
448 499
ADD_ALL_TESTS(field_tests_default, crv_len);
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4