boringssl

Mirror of BoringSSL (grpc依赖) https://boringssl.googlesource.com/boringssl

David Benjamin 55b069de8d Add a value barrier when checking for point doubling. Many of our point addition functions internally check for the doubling case and branch because the addition formulas are incomplete. This branch is fine because the multiplication formulas are arranged to not hit this case. However, we don't want to leak the couple of intermedate values that determine whether to branch. Previously, we ran into this with https://boringssl-review.googlesource.com/c/boringssl/+/36465. This wasn't sufficient. The compiler understands if (a & b) enough to compile into two branches. Thanks to Moritz Schneider, Nicolas Dutly, Daniele Lain, Ivan Puddu, and Srdjan Capkun for reporting this! Fix the leak by adding a value barrier on the final value. As we're also intentionally leaking the result of otherwise secret data flow, I've used the constant_time_declassify functions, which feed into our valgrind-based constant-time validation and double as barriers. Accordingly, I've also added some CONSTTIME_SECRET markers around the ECDSA nonce value, so we can check with valgrind the fix worked. The marker really should be at a lower level, at ec_random_nonzero_scalar or further (maybe RAND_bytes?), but for now I've just marked the nonce. To then clear valgrind, add constant_time_declassify in a few other places, like trying to convert infinity to affine coordinates. (ECDH deals with secret points, but it is public that the point isn't infinity.) Valgrind now says this code is constant-time, at least up to compilation differences introduced by the annotations. I've also inspected the compiler output. This seems to be fine, though neither test is quite satisfying. Ideally we could add annotations in ways that don't influence compiler output. Change-Id: Idfc413a75d92514717520404a0f5424903cb4453 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/60225 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> Auto-Submit: David Benjamin <davidben@google.com>		1 year ago
..
aes	Add prefetch to aes_hw_ctr32_encrypt_blocks	2 years ago
bn	Re-add go:build ignore lines	2 years ago
cipher	Make OPENSSL_malloc push ERR_R_MALLOC_FAILURE on failure.	2 years ago
cmac	Various -Wshorten-64-to-32 fixes.	2 years ago
dh	Invalidated cached RSA, DH, and DSA state when changing keys	2 years ago
digest	Make OPENSSL_malloc push ERR_R_MALLOC_FAILURE on failure.	2 years ago
digestsign	More includes for builds that don't use bcm.c	2 years ago
ec	Add a value barrier when checking for point doubling.	1 year ago
ecdh	Rename EC_RAW_POINT to EC_JACOBIAN	2 years ago
ecdsa	Add a value barrier when checking for point doubling.	1 year ago
hkdf	Update hkdf.c to avoid potentially vulnerable code pattern.	2 years ago
hmac	Tidy up HMAC_Init_ex slightly	2 years ago
md4	Extract common rotl/rotr functions.	3 years ago
md5	Extract common rotl/rotr functions.	3 years ago
modes	Remove unions in GCM implementation	2 years ago
policydocs	Include the policy document for the most recent FIPS validation.	3 years ago
rand	Fix RAND_enable_fork_unsafe_buffering when called after fork	2 years ago
rsa	Reject RSA keys under 512 bits	2 years ago
self_check	Add some missing includes	2 years ago
service_indicator	Replace the union inside EVP_PKEY with void*.	2 years ago
sha	Add prefetch to sha1_block_data_order_shaext	2 years ago
tls	Add some missing includes	2 years ago
CMakeLists.txt	Remove global_target from build.	2 years ago
FIPS.md	Add a link for FIPS cert #4409 .	2 years ago
bcm.c	Move HKDF into the FIPS module.	2 years ago
delocate.h	acvp: add CMAC-AES support.	4 years ago
fips_shared.lds	Add .text.unlikely.* pattern to fips_shared.lds.	4 years ago
fips_shared_support.c	acvp: add CMAC-AES support.	4 years ago
intcheck1.png	acvp: add CMAC-AES support.	4 years ago
intcheck2.png	acvp: add CMAC-AES support.	4 years ago
intcheck3.png	acvp: add CMAC-AES support.	4 years ago