[openssl] master update
bernd.edlinger at hotmail.de
bernd.edlinger at hotmail.de
Sun Apr 14 09:26:21 UTC 2019
The branch master has been updated
via 3051bf2afab7ac8b7b9c64e68755d1addd2fb8ff (commit)
from 938e82f622eb04ebbfe534c79d234d0f6a0df035 (commit)
- Log -----------------------------------------------------------------
commit 3051bf2afab7ac8b7b9c64e68755d1addd2fb8ff
Author: Bernd Edlinger <bernd.edlinger at hotmail.de>
Date: Fri Apr 12 14:28:00 2019 +0200
Don't use coordinate blinding when scalar is group order
This happens in ec_key_simple_check_key and EC_GROUP_check.
Since the the group order is not a secret scalar, it is
unnecessary to use coordinate blinding.
Fixes: #8731
Reviewed-by: Paul Dale <paul.dale at oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8734)
-----------------------------------------------------------------------
Summary of changes:
crypto/ec/ec_mult.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c
index 755d644..968125f 100644
--- a/crypto/ec/ec_mult.c
+++ b/crypto/ec/ec_mult.c
@@ -441,7 +441,7 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
* scalar multiplication implementation based on a Montgomery ladder,
* with various timing attack defenses.
*/
- if ((scalar != NULL) && (num == 0)) {
+ if ((scalar != group->order) && (scalar != NULL) && (num == 0)) {
/*-
* In this case we want to compute scalar * GeneratorPoint: this
* codepath is reached most prominently by (ephemeral) key
@@ -452,7 +452,7 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
*/
return ec_scalar_mul_ladder(group, r, scalar, NULL, ctx);
}
- if ((scalar == NULL) && (num == 1)) {
+ if ((scalar == NULL) && (num == 1) && (scalars[0] != group->order)) {
/*-
* In this case we want to compute scalar * VariablePoint: this
* codepath is reached most prominently by the second half of ECDH,
More information about the openssl-commits
mailing list