From 461c5a89dfd9cccd76815b2ce38e1edc501edf77 Mon Sep 17 00:00:00 2001 From: gabor-mezei-arm Date: Thu, 30 Jul 2020 16:41:25 +0200 Subject: [PATCH 01/18] Zeroize internal buffers and variables in PKCS and SHA Zeroising of local buffers and variables which are used for calculations in mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process() functions to erase sensitive data from memory. Checked all function for possible missing zeroisation in PKCS and SHA. Signed-off-by: gabor-mezei-arm --- ...oizations_of_sensitive_data_in_PKCS5_and_SHA.txt | 5 +++++ library/pkcs5.c | 9 +++++++++ library/sha1.c | 9 +++++++++ library/sha256.c | 6 ++++++ library/sha512.c | 13 +++++++++++++ 5 files changed, 42 insertions(+) create mode 100644 ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt diff --git a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt new file mode 100644 index 000000000..f8445615c --- /dev/null +++ b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt @@ -0,0 +1,5 @@ +Security + * Zeroising of local buffers and variables which are used for calculations + in mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process() + functions to erase sensitive data from memory. Reported by + Johan Malmgren and Johan Uppman Bruce from Sectra. diff --git a/library/pkcs5.c b/library/pkcs5.c index 8a80aa5d0..1533a929c 100644 --- a/library/pkcs5.c +++ b/library/pkcs5.c @@ -79,6 +79,11 @@ #define mbedtls_printf printf #endif +/* Implementation that should never be optimized out by the compiler */ +static void mbedtls_zeroize( void *v, size_t n ) { + volatile unsigned char *p = (unsigned char*)v; while( n-- ) *p++ = 0; +} + #if defined(MBEDTLS_ASN1_PARSE_C) static int pkcs5_parse_pbkdf2_params( const mbedtls_asn1_buf *params, mbedtls_asn1_buf *salt, int *iterations, @@ -312,6 +317,10 @@ int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *p break; } + /* Zeroise buffers to clear sensitive data from memory. */ + mbedtls_zeroize( work, MBEDTLS_MD_MAX_SIZE ); + mbedtls_zeroize( md1, MBEDTLS_MD_MAX_SIZE ); + return( 0 ); } diff --git a/library/sha1.c b/library/sha1.c index 83ef9bdbd..65841ee36 100644 --- a/library/sha1.c +++ b/library/sha1.c @@ -300,6 +300,15 @@ int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, ctx->state[3] += D; ctx->state[4] += E; + /* Zeroise buffers and variables to clear sensitive data from memory. */ + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + mbedtls_zeroize( &E, sizeof( E ) ); + mbedtls_zeroize( &W, sizeof( W ) ); + mbedtls_zeroize( &temp, sizeof( temp ) ); + return( 0 ); } diff --git a/library/sha256.c b/library/sha256.c index 6ae6a0ef6..9552b8ce4 100644 --- a/library/sha256.c +++ b/library/sha256.c @@ -269,6 +269,12 @@ int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, for( i = 0; i < 8; i++ ) ctx->state[i] += A[i]; + /* Zeroise buffers and variables to clear sensitive data from memory. */ + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &W, sizeof( W ) ); + mbedtls_zeroize( &temp1, sizeof( temp1 ) ); + mbedtls_zeroize( &temp2, sizeof( temp2 ) ); + return( 0 ); } diff --git a/library/sha512.c b/library/sha512.c index 0a42f5563..9e9f07359 100644 --- a/library/sha512.c +++ b/library/sha512.c @@ -300,6 +300,19 @@ int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, ctx->state[6] += G; ctx->state[7] += H; + /* Zeroise buffers and variables to clear sensitive data from memory. */ + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + mbedtls_zeroize( &E, sizeof( E ) ); + mbedtls_zeroize( &F, sizeof( F ) ); + mbedtls_zeroize( &G, sizeof( G ) ); + mbedtls_zeroize( &H, sizeof( H ) ); + mbedtls_zeroize( &W, sizeof( W ) ); + mbedtls_zeroize( &temp1, sizeof( temp1 ) ); + mbedtls_zeroize( &temp2, sizeof( temp2 ) ); + return( 0 ); } From 77d940170574fc4e347bc9bb363857269686d2bd Mon Sep 17 00:00:00 2001 From: gabor-mezei-arm Date: Wed, 19 Aug 2020 14:01:03 +0200 Subject: [PATCH 02/18] Force cleanup before return Signed-off-by: gabor-mezei-arm --- library/pkcs5.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/library/pkcs5.c b/library/pkcs5.c index 1533a929c..7d392a641 100644 --- a/library/pkcs5.c +++ b/library/pkcs5.c @@ -252,7 +252,7 @@ int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *p unsigned int iteration_count, uint32_t key_length, unsigned char *output ) { - int ret, j; + int ret = 0, j; unsigned int i; unsigned char md1[MBEDTLS_MD_MAX_SIZE]; unsigned char work[MBEDTLS_MD_MAX_SIZE]; @@ -274,16 +274,16 @@ int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *p // U1 ends up in work // if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 ) - return( ret ); + goto cleanup; if( ( ret = mbedtls_md_hmac_update( ctx, salt, slen ) ) != 0 ) - return( ret ); + goto cleanup; if( ( ret = mbedtls_md_hmac_update( ctx, counter, 4 ) ) != 0 ) - return( ret ); + goto cleanup; if( ( ret = mbedtls_md_hmac_finish( ctx, work ) ) != 0 ) - return( ret ); + goto cleanup; memcpy( md1, work, md_size ); @@ -292,13 +292,13 @@ int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *p // U2 ends up in md1 // if( ( ret = mbedtls_md_hmac_starts( ctx, password, plen ) ) != 0 ) - return( ret ); + goto cleanup; if( ( ret = mbedtls_md_hmac_update( ctx, md1, md_size ) ) != 0 ) - return( ret ); + goto cleanup; if( ( ret = mbedtls_md_hmac_finish( ctx, md1 ) ) != 0 ) - return( ret ); + goto cleanup; // U1 xor U2 // @@ -317,11 +317,12 @@ int mbedtls_pkcs5_pbkdf2_hmac( mbedtls_md_context_t *ctx, const unsigned char *p break; } +cleanup: /* Zeroise buffers to clear sensitive data from memory. */ mbedtls_zeroize( work, MBEDTLS_MD_MAX_SIZE ); mbedtls_zeroize( md1, MBEDTLS_MD_MAX_SIZE ); - return( 0 ); + return( ret ); } #if defined(MBEDTLS_SELF_TEST) From cb3a742d1d5ddebd4e25a96249af388079f2c1c9 Mon Sep 17 00:00:00 2001 From: gabor-mezei-arm Date: Wed, 19 Aug 2020 14:03:06 +0200 Subject: [PATCH 03/18] Zeroize internal buffers and variables in MD hashes Zeroising of local buffers and variables which are used for calculations in mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() functions to erase sensitive data from memory. Checked all function for possible missing zeroisation in MD. Signed-off-by: gabor-mezei-arm --- ...oizations_of_sensitive_data_in_PKCS5_and_SHA.txt | 3 ++- library/md2.c | 3 +++ library/md4.c | 7 +++++++ library/md5.c | 7 +++++++ library/ripemd160.c | 13 +++++++++++++ 5 files changed, 32 insertions(+), 1 deletion(-) diff --git a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt index f8445615c..320bb0e86 100644 --- a/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt +++ b/ChangeLog.d/zeroizations_of_sensitive_data_in_PKCS5_and_SHA.txt @@ -1,5 +1,6 @@ Security * Zeroising of local buffers and variables which are used for calculations - in mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process() + in mbedtls_pkcs5_pbkdf2_hmac(), mbedtls_internal_sha*_process(), + mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process() functions to erase sensitive data from memory. Reported by Johan Malmgren and Johan Uppman Bruce from Sectra. diff --git a/library/md2.c b/library/md2.c index 293ada304..eb4d0d03f 100644 --- a/library/md2.c +++ b/library/md2.c @@ -181,6 +181,9 @@ int mbedtls_internal_md2_process( mbedtls_md2_context *ctx ) t = ctx->cksum[i]; } + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &t, sizeof( t ) ); + return( 0 ); } diff --git a/library/md4.c b/library/md4.c index 69825595f..28e81c81d 100644 --- a/library/md4.c +++ b/library/md4.c @@ -247,6 +247,13 @@ int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, ctx->state[2] += C; ctx->state[3] += D; + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &X, sizeof( X ) ); + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + return( 0 ); } diff --git a/library/md5.c b/library/md5.c index 009a013ef..9c75caeec 100644 --- a/library/md5.c +++ b/library/md5.c @@ -266,6 +266,13 @@ int mbedtls_internal_md5_process( mbedtls_md5_context *ctx, ctx->state[2] += C; ctx->state[3] += D; + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &X, sizeof( X ) ); + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + return( 0 ); } diff --git a/library/ripemd160.c b/library/ripemd160.c index aee112311..f58507773 100644 --- a/library/ripemd160.c +++ b/library/ripemd160.c @@ -325,6 +325,19 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, ctx->state[4] = ctx->state[0] + B + Cp; ctx->state[0] = C; + /* Zeroise variables to clear sensitive data from memory. */ + mbedtls_zeroize( &A, sizeof( A ) ); + mbedtls_zeroize( &B, sizeof( B ) ); + mbedtls_zeroize( &C, sizeof( C ) ); + mbedtls_zeroize( &D, sizeof( D ) ); + mbedtls_zeroize( &E, sizeof( E ) ); + mbedtls_zeroize( &Ap, sizeof( Ap ) ); + mbedtls_zeroize( &Bp, sizeof( Bp ) ); + mbedtls_zeroize( &Cp, sizeof( Cp ) ); + mbedtls_zeroize( &Dp, sizeof( Dp ) ); + mbedtls_zeroize( &Ep, sizeof( Ep ) ); + mbedtls_zeroize( &X, sizeof( X ) ); + return( 0 ); } From bfdbd4305ac242581454cf6115c209021f05a4cc Mon Sep 17 00:00:00 2001 From: gabor-mezei-arm Date: Tue, 25 Aug 2020 19:12:01 +0200 Subject: [PATCH 04/18] Put local variables and buffers in a struct This reduces the impact of the code size increase due to the addition of calls to mbedtls_platform_zeroize. Signed-off-by: gabor-mezei-arm --- library/md4.c | 155 +++++++++++++++-------------- library/md5.c | 189 ++++++++++++++++++----------------- library/ripemd160.c | 233 +++++++++++++++++++++----------------------- library/sha1.c | 233 ++++++++++++++++++++++---------------------- library/sha256.c | 97 ++++++++++-------- library/sha512.c | 91 ++++++++--------- 6 files changed, 505 insertions(+), 493 deletions(-) diff --git a/library/md4.c b/library/md4.c index 28e81c81d..160a81497 100644 --- a/library/md4.c +++ b/library/md4.c @@ -147,51 +147,54 @@ void mbedtls_md4_starts( mbedtls_md4_context *ctx ) int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, const unsigned char data[64] ) { - uint32_t X[16], A, B, C, D; + struct + { + uint32_t X[16], A, B, C, D; + } local; - GET_UINT32_LE( X[ 0], data, 0 ); - GET_UINT32_LE( X[ 1], data, 4 ); - GET_UINT32_LE( X[ 2], data, 8 ); - GET_UINT32_LE( X[ 3], data, 12 ); - GET_UINT32_LE( X[ 4], data, 16 ); - GET_UINT32_LE( X[ 5], data, 20 ); - GET_UINT32_LE( X[ 6], data, 24 ); - GET_UINT32_LE( X[ 7], data, 28 ); - GET_UINT32_LE( X[ 8], data, 32 ); - GET_UINT32_LE( X[ 9], data, 36 ); - GET_UINT32_LE( X[10], data, 40 ); - GET_UINT32_LE( X[11], data, 44 ); - GET_UINT32_LE( X[12], data, 48 ); - GET_UINT32_LE( X[13], data, 52 ); - GET_UINT32_LE( X[14], data, 56 ); - GET_UINT32_LE( X[15], data, 60 ); + GET_UINT32_LE( local.X[ 0], data, 0 ); + GET_UINT32_LE( local.X[ 1], data, 4 ); + GET_UINT32_LE( local.X[ 2], data, 8 ); + GET_UINT32_LE( local.X[ 3], data, 12 ); + GET_UINT32_LE( local.X[ 4], data, 16 ); + GET_UINT32_LE( local.X[ 5], data, 20 ); + GET_UINT32_LE( local.X[ 6], data, 24 ); + GET_UINT32_LE( local.X[ 7], data, 28 ); + GET_UINT32_LE( local.X[ 8], data, 32 ); + GET_UINT32_LE( local.X[ 9], data, 36 ); + GET_UINT32_LE( local.X[10], data, 40 ); + GET_UINT32_LE( local.X[11], data, 44 ); + GET_UINT32_LE( local.X[12], data, 48 ); + GET_UINT32_LE( local.X[13], data, 52 ); + GET_UINT32_LE( local.X[14], data, 56 ); + GET_UINT32_LE( local.X[15], data, 60 ); #define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n))) - A = ctx->state[0]; - B = ctx->state[1]; - C = ctx->state[2]; - D = ctx->state[3]; + local.A = ctx->state[0]; + local.B = ctx->state[1]; + local.C = ctx->state[2]; + local.D = ctx->state[3]; #define F(x, y, z) ((x & y) | ((~x) & z)) #define P(a,b,c,d,x,s) { a += F(b,c,d) + x; a = S(a,s); } - P( A, B, C, D, X[ 0], 3 ); - P( D, A, B, C, X[ 1], 7 ); - P( C, D, A, B, X[ 2], 11 ); - P( B, C, D, A, X[ 3], 19 ); - P( A, B, C, D, X[ 4], 3 ); - P( D, A, B, C, X[ 5], 7 ); - P( C, D, A, B, X[ 6], 11 ); - P( B, C, D, A, X[ 7], 19 ); - P( A, B, C, D, X[ 8], 3 ); - P( D, A, B, C, X[ 9], 7 ); - P( C, D, A, B, X[10], 11 ); - P( B, C, D, A, X[11], 19 ); - P( A, B, C, D, X[12], 3 ); - P( D, A, B, C, X[13], 7 ); - P( C, D, A, B, X[14], 11 ); - P( B, C, D, A, X[15], 19 ); + P( local.A, local.B, local.C, local.D, local.X[ 0], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 1], 7 ); + P( local.C, local.D, local.A, local.B, local.X[ 2], 11 ); + P( local.B, local.C, local.D, local.A, local.X[ 3], 19 ); + P( local.A, local.B, local.C, local.D, local.X[ 4], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 5], 7 ); + P( local.C, local.D, local.A, local.B, local.X[ 6], 11 ); + P( local.B, local.C, local.D, local.A, local.X[ 7], 19 ); + P( local.A, local.B, local.C, local.D, local.X[ 8], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 9], 7 ); + P( local.C, local.D, local.A, local.B, local.X[10], 11 ); + P( local.B, local.C, local.D, local.A, local.X[11], 19 ); + P( local.A, local.B, local.C, local.D, local.X[12], 3 ); + P( local.D, local.A, local.B, local.C, local.X[13], 7 ); + P( local.C, local.D, local.A, local.B, local.X[14], 11 ); + P( local.B, local.C, local.D, local.A, local.X[15], 19 ); #undef P #undef F @@ -199,22 +202,22 @@ int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, #define F(x,y,z) ((x & y) | (x & z) | (y & z)) #define P(a,b,c,d,x,s) { a += F(b,c,d) + x + 0x5A827999; a = S(a,s); } - P( A, B, C, D, X[ 0], 3 ); - P( D, A, B, C, X[ 4], 5 ); - P( C, D, A, B, X[ 8], 9 ); - P( B, C, D, A, X[12], 13 ); - P( A, B, C, D, X[ 1], 3 ); - P( D, A, B, C, X[ 5], 5 ); - P( C, D, A, B, X[ 9], 9 ); - P( B, C, D, A, X[13], 13 ); - P( A, B, C, D, X[ 2], 3 ); - P( D, A, B, C, X[ 6], 5 ); - P( C, D, A, B, X[10], 9 ); - P( B, C, D, A, X[14], 13 ); - P( A, B, C, D, X[ 3], 3 ); - P( D, A, B, C, X[ 7], 5 ); - P( C, D, A, B, X[11], 9 ); - P( B, C, D, A, X[15], 13 ); + P( local.A, local.B, local.C, local.D, local.X[ 0], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 4], 5 ); + P( local.C, local.D, local.A, local.B, local.X[ 8], 9 ); + P( local.B, local.C, local.D, local.A, local.X[12], 13 ); + P( local.A, local.B, local.C, local.D, local.X[ 1], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 5], 5 ); + P( local.C, local.D, local.A, local.B, local.X[ 9], 9 ); + P( local.B, local.C, local.D, local.A, local.X[13], 13 ); + P( local.A, local.B, local.C, local.D, local.X[ 2], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 6], 5 ); + P( local.C, local.D, local.A, local.B, local.X[10], 9 ); + P( local.B, local.C, local.D, local.A, local.X[14], 13 ); + P( local.A, local.B, local.C, local.D, local.X[ 3], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 7], 5 ); + P( local.C, local.D, local.A, local.B, local.X[11], 9 ); + P( local.B, local.C, local.D, local.A, local.X[15], 13 ); #undef P #undef F @@ -222,37 +225,33 @@ int mbedtls_internal_md4_process( mbedtls_md4_context *ctx, #define F(x,y,z) (x ^ y ^ z) #define P(a,b,c,d,x,s) { a += F(b,c,d) + x + 0x6ED9EBA1; a = S(a,s); } - P( A, B, C, D, X[ 0], 3 ); - P( D, A, B, C, X[ 8], 9 ); - P( C, D, A, B, X[ 4], 11 ); - P( B, C, D, A, X[12], 15 ); - P( A, B, C, D, X[ 2], 3 ); - P( D, A, B, C, X[10], 9 ); - P( C, D, A, B, X[ 6], 11 ); - P( B, C, D, A, X[14], 15 ); - P( A, B, C, D, X[ 1], 3 ); - P( D, A, B, C, X[ 9], 9 ); - P( C, D, A, B, X[ 5], 11 ); - P( B, C, D, A, X[13], 15 ); - P( A, B, C, D, X[ 3], 3 ); - P( D, A, B, C, X[11], 9 ); - P( C, D, A, B, X[ 7], 11 ); - P( B, C, D, A, X[15], 15 ); + P( local.A, local.B, local.C, local.D, local.X[ 0], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 8], 9 ); + P( local.C, local.D, local.A, local.B, local.X[ 4], 11 ); + P( local.B, local.C, local.D, local.A, local.X[12], 15 ); + P( local.A, local.B, local.C, local.D, local.X[ 2], 3 ); + P( local.D, local.A, local.B, local.C, local.X[10], 9 ); + P( local.C, local.D, local.A, local.B, local.X[ 6], 11 ); + P( local.B, local.C, local.D, local.A, local.X[14], 15 ); + P( local.A, local.B, local.C, local.D, local.X[ 1], 3 ); + P( local.D, local.A, local.B, local.C, local.X[ 9], 9 ); + P( local.C, local.D, local.A, local.B, local.X[ 5], 11 ); + P( local.B, local.C, local.D, local.A, local.X[13], 15 ); + P( local.A, local.B, local.C, local.D, local.X[ 3], 3 ); + P( local.D, local.A, local.B, local.C, local.X[11], 9 ); + P( local.C, local.D, local.A, local.B, local.X[ 7], 11 ); + P( local.B, local.C, local.D, local.A, local.X[15], 15 ); #undef F #undef P - ctx->state[0] += A; - ctx->state[1] += B; - ctx->state[2] += C; - ctx->state[3] += D; + ctx->state[0] += local.A; + ctx->state[1] += local.B; + ctx->state[2] += local.C; + ctx->state[3] += local.D; /* Zeroise variables to clear sensitive data from memory. */ - mbedtls_zeroize( &X, sizeof( X ) ); - mbedtls_zeroize( &A, sizeof( A ) ); - mbedtls_zeroize( &B, sizeof( B ) ); - mbedtls_zeroize( &C, sizeof( C ) ); - mbedtls_zeroize( &D, sizeof( D ) ); + mbedtls_zeroize( &local, sizeof( local ) ); return( 0 ); } diff --git a/library/md5.c b/library/md5.c index 9c75caeec..125406f1c 100644 --- a/library/md5.c +++ b/library/md5.c @@ -146,132 +146,131 @@ void mbedtls_md5_starts( mbedtls_md5_context *ctx ) int mbedtls_internal_md5_process( mbedtls_md5_context *ctx, const unsigned char data[64] ) { - uint32_t X[16], A, B, C, D; + struct + { + uint32_t X[16], A, B, C, D; + } local; - GET_UINT32_LE( X[ 0], data, 0 ); - GET_UINT32_LE( X[ 1], data, 4 ); - GET_UINT32_LE( X[ 2], data, 8 ); - GET_UINT32_LE( X[ 3], data, 12 ); - GET_UINT32_LE( X[ 4], data, 16 ); - GET_UINT32_LE( X[ 5], data, 20 ); - GET_UINT32_LE( X[ 6], data, 24 ); - GET_UINT32_LE( X[ 7], data, 28 ); - GET_UINT32_LE( X[ 8], data, 32 ); - GET_UINT32_LE( X[ 9], data, 36 ); - GET_UINT32_LE( X[10], data, 40 ); - GET_UINT32_LE( X[11], data, 44 ); - GET_UINT32_LE( X[12], data, 48 ); - GET_UINT32_LE( X[13], data, 52 ); - GET_UINT32_LE( X[14], data, 56 ); - GET_UINT32_LE( X[15], data, 60 ); + GET_UINT32_LE( local.X[ 0], data, 0 ); + GET_UINT32_LE( local.X[ 1], data, 4 ); + GET_UINT32_LE( local.X[ 2], data, 8 ); + GET_UINT32_LE( local.X[ 3], data, 12 ); + GET_UINT32_LE( local.X[ 4], data, 16 ); + GET_UINT32_LE( local.X[ 5], data, 20 ); + GET_UINT32_LE( local.X[ 6], data, 24 ); + GET_UINT32_LE( local.X[ 7], data, 28 ); + GET_UINT32_LE( local.X[ 8], data, 32 ); + GET_UINT32_LE( local.X[ 9], data, 36 ); + GET_UINT32_LE( local.X[10], data, 40 ); + GET_UINT32_LE( local.X[11], data, 44 ); + GET_UINT32_LE( local.X[12], data, 48 ); + GET_UINT32_LE( local.X[13], data, 52 ); + GET_UINT32_LE( local.X[14], data, 56 ); + GET_UINT32_LE( local.X[15], data, 60 ); #define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n))) #define P(a,b,c,d,k,s,t) \ { \ - a += F(b,c,d) + X[k] + t; a = S(a,s) + b; \ + a += F(b,c,d) + local.X[k] + t; a = S(a,s) + b; \ } - A = ctx->state[0]; - B = ctx->state[1]; - C = ctx->state[2]; - D = ctx->state[3]; + local.A = ctx->state[0]; + local.B = ctx->state[1]; + local.C = ctx->state[2]; + local.D = ctx->state[3]; #define F(x,y,z) (z ^ (x & (y ^ z))) - P( A, B, C, D, 0, 7, 0xD76AA478 ); - P( D, A, B, C, 1, 12, 0xE8C7B756 ); - P( C, D, A, B, 2, 17, 0x242070DB ); - P( B, C, D, A, 3, 22, 0xC1BDCEEE ); - P( A, B, C, D, 4, 7, 0xF57C0FAF ); - P( D, A, B, C, 5, 12, 0x4787C62A ); - P( C, D, A, B, 6, 17, 0xA8304613 ); - P( B, C, D, A, 7, 22, 0xFD469501 ); - P( A, B, C, D, 8, 7, 0x698098D8 ); - P( D, A, B, C, 9, 12, 0x8B44F7AF ); - P( C, D, A, B, 10, 17, 0xFFFF5BB1 ); - P( B, C, D, A, 11, 22, 0x895CD7BE ); - P( A, B, C, D, 12, 7, 0x6B901122 ); - P( D, A, B, C, 13, 12, 0xFD987193 ); - P( C, D, A, B, 14, 17, 0xA679438E ); - P( B, C, D, A, 15, 22, 0x49B40821 ); + P( local.A, local.B, local.C, local.D, 0, 7, 0xD76AA478 ); + P( local.D, local.A, local.B, local.C, 1, 12, 0xE8C7B756 ); + P( local.C, local.D, local.A, local.B, 2, 17, 0x242070DB ); + P( local.B, local.C, local.D, local.A, 3, 22, 0xC1BDCEEE ); + P( local.A, local.B, local.C, local.D, 4, 7, 0xF57C0FAF ); + P( local.D, local.A, local.B, local.C, 5, 12, 0x4787C62A ); + P( local.C, local.D, local.A, local.B, 6, 17, 0xA8304613 ); + P( local.B, local.C, local.D, local.A, 7, 22, 0xFD469501 ); + P( local.A, local.B, local.C, local.D, 8, 7, 0x698098D8 ); + P( local.D, local.A, local.B, local.C, 9, 12, 0x8B44F7AF ); + P( local.C, local.D, local.A, local.B, 10, 17, 0xFFFF5BB1 ); + P( local.B, local.C, local.D, local.A, 11, 22, 0x895CD7BE ); + P( local.A, local.B, local.C, local.D, 12, 7, 0x6B901122 ); + P( local.D, local.A, local.B, local.C, 13, 12, 0xFD987193 ); + P( local.C, local.D, local.A, local.B, 14, 17, 0xA679438E ); + P( local.B, local.C, local.D, local.A, 15, 22, 0x49B40821 ); #undef F #define F(x,y,z) (y ^ (z & (x ^ y))) - P( A, B, C, D, 1, 5, 0xF61E2562 ); - P( D, A, B, C, 6, 9, 0xC040B340 ); - P( C, D, A, B, 11, 14, 0x265E5A51 ); - P( B, C, D, A, 0, 20, 0xE9B6C7AA ); - P( A, B, C, D, 5, 5, 0xD62F105D ); - P( D, A, B, C, 10, 9, 0x02441453 ); - P( C, D, A, B, 15, 14, 0xD8A1E681 ); - P( B, C, D, A, 4, 20, 0xE7D3FBC8 ); - P( A, B, C, D, 9, 5, 0x21E1CDE6 ); - P( D, A, B, C, 14, 9, 0xC33707D6 ); - P( C, D, A, B, 3, 14, 0xF4D50D87 ); - P( B, C, D, A, 8, 20, 0x455A14ED ); - P( A, B, C, D, 13, 5, 0xA9E3E905 ); - P( D, A, B, C, 2, 9, 0xFCEFA3F8 ); - P( C, D, A, B, 7, 14, 0x676F02D9 ); - P( B, C, D, A, 12, 20, 0x8D2A4C8A ); + P( local.A, local.B, local.C, local.D, 1, 5, 0xF61E2562 ); + P( local.D, local.A, local.B, local.C, 6, 9, 0xC040B340 ); + P( local.C, local.D, local.A, local.B, 11, 14, 0x265E5A51 ); + P( local.B, local.C, local.D, local.A, 0, 20, 0xE9B6C7AA ); + P( local.A, local.B, local.C, local.D, 5, 5, 0xD62F105D ); + P( local.D, local.A, local.B, local.C, 10, 9, 0x02441453 ); + P( local.C, local.D, local.A, local.B, 15, 14, 0xD8A1E681 ); + P( local.B, local.C, local.D, local.A, 4, 20, 0xE7D3FBC8 ); + P( local.A, local.B, local.C, local.D, 9, 5, 0x21E1CDE6 ); + P( local.D, local.A, local.B, local.C, 14, 9, 0xC33707D6 ); + P( local.C, local.D, local.A, local.B, 3, 14, 0xF4D50D87 ); + P( local.B, local.C, local.D, local.A, 8, 20, 0x455A14ED ); + P( local.A, local.B, local.C, local.D, 13, 5, 0xA9E3E905 ); + P( local.D, local.A, local.B, local.C, 2, 9, 0xFCEFA3F8 ); + P( local.C, local.D, local.A, local.B, 7, 14, 0x676F02D9 ); + P( local.B, local.C, local.D, local.A, 12, 20, 0x8D2A4C8A ); #undef F #define F(x,y,z) (x ^ y ^ z) - P( A, B, C, D, 5, 4, 0xFFFA3942 ); - P( D, A, B, C, 8, 11, 0x8771F681 ); - P( C, D, A, B, 11, 16, 0x6D9D6122 ); - P( B, C, D, A, 14, 23, 0xFDE5380C ); - P( A, B, C, D, 1, 4, 0xA4BEEA44 ); - P( D, A, B, C, 4, 11, 0x4BDECFA9 ); - P( C, D, A, B, 7, 16, 0xF6BB4B60 ); - P( B, C, D, A, 10, 23, 0xBEBFBC70 ); - P( A, B, C, D, 13, 4, 0x289B7EC6 ); - P( D, A, B, C, 0, 11, 0xEAA127FA ); - P( C, D, A, B, 3, 16, 0xD4EF3085 ); - P( B, C, D, A, 6, 23, 0x04881D05 ); - P( A, B, C, D, 9, 4, 0xD9D4D039 ); - P( D, A, B, C, 12, 11, 0xE6DB99E5 ); - P( C, D, A, B, 15, 16, 0x1FA27CF8 ); - P( B, C, D, A, 2, 23, 0xC4AC5665 ); + P( local.A, local.B, local.C, local.D, 5, 4, 0xFFFA3942 ); + P( local.D, local.A, local.B, local.C, 8, 11, 0x8771F681 ); + P( local.C, local.D, local.A, local.B, 11, 16, 0x6D9D6122 ); + P( local.B, local.C, local.D, local.A, 14, 23, 0xFDE5380C ); + P( local.A, local.B, local.C, local.D, 1, 4, 0xA4BEEA44 ); + P( local.D, local.A, local.B, local.C, 4, 11, 0x4BDECFA9 ); + P( local.C, local.D, local.A, local.B, 7, 16, 0xF6BB4B60 ); + P( local.B, local.C, local.D, local.A, 10, 23, 0xBEBFBC70 ); + P( local.A, local.B, local.C, local.D, 13, 4, 0x289B7EC6 ); + P( local.D, local.A, local.B, local.C, 0, 11, 0xEAA127FA ); + P( local.C, local.D, local.A, local.B, 3, 16, 0xD4EF3085 ); + P( local.B, local.C, local.D, local.A, 6, 23, 0x04881D05 ); + P( local.A, local.B, local.C, local.D, 9, 4, 0xD9D4D039 ); + P( local.D, local.A, local.B, local.C, 12, 11, 0xE6DB99E5 ); + P( local.C, local.D, local.A, local.B, 15, 16, 0x1FA27CF8 ); + P( local.B, local.C, local.D, local.A, 2, 23, 0xC4AC5665 ); #undef F #define F(x,y,z) (y ^ (x | ~z)) - P( A, B, C, D, 0, 6, 0xF4292244 ); - P( D, A, B, C, 7, 10, 0x432AFF97 ); - P( C, D, A, B, 14, 15, 0xAB9423A7 ); - P( B, C, D, A, 5, 21, 0xFC93A039 ); - P( A, B, C, D, 12, 6, 0x655B59C3 ); - P( D, A, B, C, 3, 10, 0x8F0CCC92 ); - P( C, D, A, B, 10, 15, 0xFFEFF47D ); - P( B, C, D, A, 1, 21, 0x85845DD1 ); - P( A, B, C, D, 8, 6, 0x6FA87E4F ); - P( D, A, B, C, 15, 10, 0xFE2CE6E0 ); - P( C, D, A, B, 6, 15, 0xA3014314 ); - P( B, C, D, A, 13, 21, 0x4E0811A1 ); - P( A, B, C, D, 4, 6, 0xF7537E82 ); - P( D, A, B, C, 11, 10, 0xBD3AF235 ); - P( C, D, A, B, 2, 15, 0x2AD7D2BB ); - P( B, C, D, A, 9, 21, 0xEB86D391 ); + P( local.A, local.B, local.C, local.D, 0, 6, 0xF4292244 ); + P( local.D, local.A, local.B, local.C, 7, 10, 0x432AFF97 ); + P( local.C, local.D, local.A, local.B, 14, 15, 0xAB9423A7 ); + P( local.B, local.C, local.D, local.A, 5, 21, 0xFC93A039 ); + P( local.A, local.B, local.C, local.D, 12, 6, 0x655B59C3 ); + P( local.D, local.A, local.B, local.C, 3, 10, 0x8F0CCC92 ); + P( local.C, local.D, local.A, local.B, 10, 15, 0xFFEFF47D ); + P( local.B, local.C, local.D, local.A, 1, 21, 0x85845DD1 ); + P( local.A, local.B, local.C, local.D, 8, 6, 0x6FA87E4F ); + P( local.D, local.A, local.B, local.C, 15, 10, 0xFE2CE6E0 ); + P( local.C, local.D, local.A, local.B, 6, 15, 0xA3014314 ); + P( local.B, local.C, local.D, local.A, 13, 21, 0x4E0811A1 ); + P( local.A, local.B, local.C, local.D, 4, 6, 0xF7537E82 ); + P( local.D, local.A, local.B, local.C, 11, 10, 0xBD3AF235 ); + P( local.C, local.D, local.A, local.B, 2, 15, 0x2AD7D2BB ); + P( local.B, local.C, local.D, local.A, 9, 21, 0xEB86D391 ); #undef F - ctx->state[0] += A; - ctx->state[1] += B; - ctx->state[2] += C; - ctx->state[3] += D; + ctx->state[0] += local.A; + ctx->state[1] += local.B; + ctx->state[2] += local.C; + ctx->state[3] += local.D; /* Zeroise variables to clear sensitive data from memory. */ - mbedtls_zeroize( &X, sizeof( X ) ); - mbedtls_zeroize( &A, sizeof( A ) ); - mbedtls_zeroize( &B, sizeof( B ) ); - mbedtls_zeroize( &C, sizeof( C ) ); - mbedtls_zeroize( &D, sizeof( D ) ); + mbedtls_zeroize( &local, sizeof( local ) ); return( 0 ); } diff --git a/library/ripemd160.c b/library/ripemd160.c index f58507773..d89ed0a30 100644 --- a/library/ripemd160.c +++ b/library/ripemd160.c @@ -151,30 +151,33 @@ void mbedtls_ripemd160_starts( mbedtls_ripemd160_context *ctx ) int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, const unsigned char data[64] ) { - uint32_t A, B, C, D, E, Ap, Bp, Cp, Dp, Ep, X[16]; + struct + { + uint32_t A, B, C, D, E, Ap, Bp, Cp, Dp, Ep, X[16]; + } local; - GET_UINT32_LE( X[ 0], data, 0 ); - GET_UINT32_LE( X[ 1], data, 4 ); - GET_UINT32_LE( X[ 2], data, 8 ); - GET_UINT32_LE( X[ 3], data, 12 ); - GET_UINT32_LE( X[ 4], data, 16 ); - GET_UINT32_LE( X[ 5], data, 20 ); - GET_UINT32_LE( X[ 6], data, 24 ); - GET_UINT32_LE( X[ 7], data, 28 ); - GET_UINT32_LE( X[ 8], data, 32 ); - GET_UINT32_LE( X[ 9], data, 36 ); - GET_UINT32_LE( X[10], data, 40 ); - GET_UINT32_LE( X[11], data, 44 ); - GET_UINT32_LE( X[12], data, 48 ); - GET_UINT32_LE( X[13], data, 52 ); - GET_UINT32_LE( X[14], data, 56 ); - GET_UINT32_LE( X[15], data, 60 ); + GET_UINT32_LE( local.X[ 0], data, 0 ); + GET_UINT32_LE( local.X[ 1], data, 4 ); + GET_UINT32_LE( local.X[ 2], data, 8 ); + GET_UINT32_LE( local.X[ 3], data, 12 ); + GET_UINT32_LE( local.X[ 4], data, 16 ); + GET_UINT32_LE( local.X[ 5], data, 20 ); + GET_UINT32_LE( local.X[ 6], data, 24 ); + GET_UINT32_LE( local.X[ 7], data, 28 ); + GET_UINT32_LE( local.X[ 8], data, 32 ); + GET_UINT32_LE( local.X[ 9], data, 36 ); + GET_UINT32_LE( local.X[10], data, 40 ); + GET_UINT32_LE( local.X[11], data, 44 ); + GET_UINT32_LE( local.X[12], data, 48 ); + GET_UINT32_LE( local.X[13], data, 52 ); + GET_UINT32_LE( local.X[14], data, 56 ); + GET_UINT32_LE( local.X[15], data, 60 ); - A = Ap = ctx->state[0]; - B = Bp = ctx->state[1]; - C = Cp = ctx->state[2]; - D = Dp = ctx->state[3]; - E = Ep = ctx->state[4]; + local.A = local.Ap = ctx->state[0]; + local.B = local.Bp = ctx->state[1]; + local.C = local.Cp = ctx->state[2]; + local.D = local.Dp = ctx->state[3]; + local.E = local.Ep = ctx->state[4]; #define F1( x, y, z ) ( x ^ y ^ z ) #define F2( x, y, z ) ( ( x & y ) | ( ~x & z ) ) @@ -185,7 +188,7 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, #define S( x, n ) ( ( x << n ) | ( x >> (32 - n) ) ) #define P( a, b, c, d, e, r, s, f, k ) \ - a += f( b, c, d ) + X[r] + k; \ + a += f( b, c, d ) + local.X[r] + k; \ a = S( a, s ) + e; \ c = S( c, 10 ); @@ -197,22 +200,22 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, #define K 0x00000000 #define Fp F5 #define Kp 0x50A28BE6 - P2( A, B, C, D, E, 0, 11, 5, 8 ); - P2( E, A, B, C, D, 1, 14, 14, 9 ); - P2( D, E, A, B, C, 2, 15, 7, 9 ); - P2( C, D, E, A, B, 3, 12, 0, 11 ); - P2( B, C, D, E, A, 4, 5, 9, 13 ); - P2( A, B, C, D, E, 5, 8, 2, 15 ); - P2( E, A, B, C, D, 6, 7, 11, 15 ); - P2( D, E, A, B, C, 7, 9, 4, 5 ); - P2( C, D, E, A, B, 8, 11, 13, 7 ); - P2( B, C, D, E, A, 9, 13, 6, 7 ); - P2( A, B, C, D, E, 10, 14, 15, 8 ); - P2( E, A, B, C, D, 11, 15, 8, 11 ); - P2( D, E, A, B, C, 12, 6, 1, 14 ); - P2( C, D, E, A, B, 13, 7, 10, 14 ); - P2( B, C, D, E, A, 14, 9, 3, 12 ); - P2( A, B, C, D, E, 15, 8, 12, 6 ); + P2( local.A, local.B, local.C, local.D, local.E, 0, 11, 5, 8 ); + P2( local.E, local.A, local.B, local.C, local.D, 1, 14, 14, 9 ); + P2( local.D, local.E, local.A, local.B, local.C, 2, 15, 7, 9 ); + P2( local.C, local.D, local.E, local.A, local.B, 3, 12, 0, 11 ); + P2( local.B, local.C, local.D, local.E, local.A, 4, 5, 9, 13 ); + P2( local.A, local.B, local.C, local.D, local.E, 5, 8, 2, 15 ); + P2( local.E, local.A, local.B, local.C, local.D, 6, 7, 11, 15 ); + P2( local.D, local.E, local.A, local.B, local.C, 7, 9, 4, 5 ); + P2( local.C, local.D, local.E, local.A, local.B, 8, 11, 13, 7 ); + P2( local.B, local.C, local.D, local.E, local.A, 9, 13, 6, 7 ); + P2( local.A, local.B, local.C, local.D, local.E, 10, 14, 15, 8 ); + P2( local.E, local.A, local.B, local.C, local.D, 11, 15, 8, 11 ); + P2( local.D, local.E, local.A, local.B, local.C, 12, 6, 1, 14 ); + P2( local.C, local.D, local.E, local.A, local.B, 13, 7, 10, 14 ); + P2( local.B, local.C, local.D, local.E, local.A, 14, 9, 3, 12 ); + P2( local.A, local.B, local.C, local.D, local.E, 15, 8, 12, 6 ); #undef F #undef K #undef Fp @@ -222,22 +225,22 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, #define K 0x5A827999 #define Fp F4 #define Kp 0x5C4DD124 - P2( E, A, B, C, D, 7, 7, 6, 9 ); - P2( D, E, A, B, C, 4, 6, 11, 13 ); - P2( C, D, E, A, B, 13, 8, 3, 15 ); - P2( B, C, D, E, A, 1, 13, 7, 7 ); - P2( A, B, C, D, E, 10, 11, 0, 12 ); - P2( E, A, B, C, D, 6, 9, 13, 8 ); - P2( D, E, A, B, C, 15, 7, 5, 9 ); - P2( C, D, E, A, B, 3, 15, 10, 11 ); - P2( B, C, D, E, A, 12, 7, 14, 7 ); - P2( A, B, C, D, E, 0, 12, 15, 7 ); - P2( E, A, B, C, D, 9, 15, 8, 12 ); - P2( D, E, A, B, C, 5, 9, 12, 7 ); - P2( C, D, E, A, B, 2, 11, 4, 6 ); - P2( B, C, D, E, A, 14, 7, 9, 15 ); - P2( A, B, C, D, E, 11, 13, 1, 13 ); - P2( E, A, B, C, D, 8, 12, 2, 11 ); + P2( local.E, local.A, local.B, local.C, local.D, 7, 7, 6, 9 ); + P2( local.D, local.E, local.A, local.B, local.C, 4, 6, 11, 13 ); + P2( local.C, local.D, local.E, local.A, local.B, 13, 8, 3, 15 ); + P2( local.B, local.C, local.D, local.E, local.A, 1, 13, 7, 7 ); + P2( local.A, local.B, local.C, local.D, local.E, 10, 11, 0, 12 ); + P2( local.E, local.A, local.B, local.C, local.D, 6, 9, 13, 8 ); + P2( local.D, local.E, local.A, local.B, local.C, 15, 7, 5, 9 ); + P2( local.C, local.D, local.E, local.A, local.B, 3, 15, 10, 11 ); + P2( local.B, local.C, local.D, local.E, local.A, 12, 7, 14, 7 ); + P2( local.A, local.B, local.C, local.D, local.E, 0, 12, 15, 7 ); + P2( local.E, local.A, local.B, local.C, local.D, 9, 15, 8, 12 ); + P2( local.D, local.E, local.A, local.B, local.C, 5, 9, 12, 7 ); + P2( local.C, local.D, local.E, local.A, local.B, 2, 11, 4, 6 ); + P2( local.B, local.C, local.D, local.E, local.A, 14, 7, 9, 15 ); + P2( local.A, local.B, local.C, local.D, local.E, 11, 13, 1, 13 ); + P2( local.E, local.A, local.B, local.C, local.D, 8, 12, 2, 11 ); #undef F #undef K #undef Fp @@ -247,22 +250,22 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, #define K 0x6ED9EBA1 #define Fp F3 #define Kp 0x6D703EF3 - P2( D, E, A, B, C, 3, 11, 15, 9 ); - P2( C, D, E, A, B, 10, 13, 5, 7 ); - P2( B, C, D, E, A, 14, 6, 1, 15 ); - P2( A, B, C, D, E, 4, 7, 3, 11 ); - P2( E, A, B, C, D, 9, 14, 7, 8 ); - P2( D, E, A, B, C, 15, 9, 14, 6 ); - P2( C, D, E, A, B, 8, 13, 6, 6 ); - P2( B, C, D, E, A, 1, 15, 9, 14 ); - P2( A, B, C, D, E, 2, 14, 11, 12 ); - P2( E, A, B, C, D, 7, 8, 8, 13 ); - P2( D, E, A, B, C, 0, 13, 12, 5 ); - P2( C, D, E, A, B, 6, 6, 2, 14 ); - P2( B, C, D, E, A, 13, 5, 10, 13 ); - P2( A, B, C, D, E, 11, 12, 0, 13 ); - P2( E, A, B, C, D, 5, 7, 4, 7 ); - P2( D, E, A, B, C, 12, 5, 13, 5 ); + P2( local.D, local.E, local.A, local.B, local.C, 3, 11, 15, 9 ); + P2( local.C, local.D, local.E, local.A, local.B, 10, 13, 5, 7 ); + P2( local.B, local.C, local.D, local.E, local.A, 14, 6, 1, 15 ); + P2( local.A, local.B, local.C, local.D, local.E, 4, 7, 3, 11 ); + P2( local.E, local.A, local.B, local.C, local.D, 9, 14, 7, 8 ); + P2( local.D, local.E, local.A, local.B, local.C, 15, 9, 14, 6 ); + P2( local.C, local.D, local.E, local.A, local.B, 8, 13, 6, 6 ); + P2( local.B, local.C, local.D, local.E, local.A, 1, 15, 9, 14 ); + P2( local.A, local.B, local.C, local.D, local.E, 2, 14, 11, 12 ); + P2( local.E, local.A, local.B, local.C, local.D, 7, 8, 8, 13 ); + P2( local.D, local.E, local.A, local.B, local.C, 0, 13, 12, 5 ); + P2( local.C, local.D, local.E, local.A, local.B, 6, 6, 2, 14 ); + P2( local.B, local.C, local.D, local.E, local.A, 13, 5, 10, 13 ); + P2( local.A, local.B, local.C, local.D, local.E, 11, 12, 0, 13 ); + P2( local.E, local.A, local.B, local.C, local.D, 5, 7, 4, 7 ); + P2( local.D, local.E, local.A, local.B, local.C, 12, 5, 13, 5 ); #undef F #undef K #undef Fp @@ -272,22 +275,22 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, #define K 0x8F1BBCDC #define Fp F2 #define Kp 0x7A6D76E9 - P2( C, D, E, A, B, 1, 11, 8, 15 ); - P2( B, C, D, E, A, 9, 12, 6, 5 ); - P2( A, B, C, D, E, 11, 14, 4, 8 ); - P2( E, A, B, C, D, 10, 15, 1, 11 ); - P2( D, E, A, B, C, 0, 14, 3, 14 ); - P2( C, D, E, A, B, 8, 15, 11, 14 ); - P2( B, C, D, E, A, 12, 9, 15, 6 ); - P2( A, B, C, D, E, 4, 8, 0, 14 ); - P2( E, A, B, C, D, 13, 9, 5, 6 ); - P2( D, E, A, B, C, 3, 14, 12, 9 ); - P2( C, D, E, A, B, 7, 5, 2, 12 ); - P2( B, C, D, E, A, 15, 6, 13, 9 ); - P2( A, B, C, D, E, 14, 8, 9, 12 ); - P2( E, A, B, C, D, 5, 6, 7, 5 ); - P2( D, E, A, B, C, 6, 5, 10, 15 ); - P2( C, D, E, A, B, 2, 12, 14, 8 ); + P2( local.C, local.D, local.E, local.A, local.B, 1, 11, 8, 15 ); + P2( local.B, local.C, local.D, local.E, local.A, 9, 12, 6, 5 ); + P2( local.A, local.B, local.C, local.D, local.E, 11, 14, 4, 8 ); + P2( local.E, local.A, local.B, local.C, local.D, 10, 15, 1, 11 ); + P2( local.D, local.E, local.A, local.B, local.C, 0, 14, 3, 14 ); + P2( local.C, local.D, local.E, local.A, local.B, 8, 15, 11, 14 ); + P2( local.B, local.C, local.D, local.E, local.A, 12, 9, 15, 6 ); + P2( local.A, local.B, local.C, local.D, local.E, 4, 8, 0, 14 ); + P2( local.E, local.A, local.B, local.C, local.D, 13, 9, 5, 6 ); + P2( local.D, local.E, local.A, local.B, local.C, 3, 14, 12, 9 ); + P2( local.C, local.D, local.E, local.A, local.B, 7, 5, 2, 12 ); + P2( local.B, local.C, local.D, local.E, local.A, 15, 6, 13, 9 ); + P2( local.A, local.B, local.C, local.D, local.E, 14, 8, 9, 12 ); + P2( local.E, local.A, local.B, local.C, local.D, 5, 6, 7, 5 ); + P2( local.D, local.E, local.A, local.B, local.C, 6, 5, 10, 15 ); + P2( local.C, local.D, local.E, local.A, local.B, 2, 12, 14, 8 ); #undef F #undef K #undef Fp @@ -297,46 +300,36 @@ int mbedtls_internal_ripemd160_process( mbedtls_ripemd160_context *ctx, #define K 0xA953FD4E #define Fp F1 #define Kp 0x00000000 - P2( B, C, D, E, A, 4, 9, 12, 8 ); - P2( A, B, C, D, E, 0, 15, 15, 5 ); - P2( E, A, B, C, D, 5, 5, 10, 12 ); - P2( D, E, A, B, C, 9, 11, 4, 9 ); - P2( C, D, E, A, B, 7, 6, 1, 12 ); - P2( B, C, D, E, A, 12, 8, 5, 5 ); - P2( A, B, C, D, E, 2, 13, 8, 14 ); - P2( E, A, B, C, D, 10, 12, 7, 6 ); - P2( D, E, A, B, C, 14, 5, 6, 8 ); - P2( C, D, E, A, B, 1, 12, 2, 13 ); - P2( B, C, D, E, A, 3, 13, 13, 6 ); - P2( A, B, C, D, E, 8, 14, 14, 5 ); - P2( E, A, B, C, D, 11, 11, 0, 15 ); - P2( D, E, A, B, C, 6, 8, 3, 13 ); - P2( C, D, E, A, B, 15, 5, 9, 11 ); - P2( B, C, D, E, A, 13, 6, 11, 11 ); + P2( local.B, local.C, local.D, local.E, local.A, 4, 9, 12, 8 ); + P2( local.A, local.B, local.C, local.D, local.E, 0, 15, 15, 5 ); + P2( local.E, local.A, local.B, local.C, local.D, 5, 5, 10, 12 ); + P2( local.D, local.E, local.A, local.B, local.C, 9, 11, 4, 9 ); + P2( local.C, local.D, local.E, local.A, local.B, 7, 6, 1, 12 ); + P2( local.B, local.C, local.D, local.E, local.A, 12, 8, 5, 5 ); + P2( local.A, local.B, local.C, local.D, local.E, 2, 13, 8, 14 ); + P2( local.E, local.A, local.B, local.C, local.D, 10, 12, 7, 6 ); + P2( local.D, local.E, local.A, local.B, local.C, 14, 5, 6, 8 ); + P2( local.C, local.D, local.E, local.A, local.B, 1, 12, 2, 13 ); + P2( local.B, local.C, local.D, local.E, local.A, 3, 13, 13, 6 ); + P2( local.A, local.B, local.C, local.D, local.E, 8, 14, 14, 5 ); + P2( local.E, local.A, local.B, local.C, local.D, 11, 11, 0, 15 ); + P2( local.D, local.E, local.A, local.B, local.C, 6, 8, 3, 13 ); + P2( local.C, local.D, local.E, local.A, local.B, 15, 5, 9, 11 ); + P2( local.B, local.C, local.D, local.E, local.A, 13, 6, 11, 11 ); #undef F #undef K #undef Fp #undef Kp - C = ctx->state[1] + C + Dp; - ctx->state[1] = ctx->state[2] + D + Ep; - ctx->state[2] = ctx->state[3] + E + Ap; - ctx->state[3] = ctx->state[4] + A + Bp; - ctx->state[4] = ctx->state[0] + B + Cp; - ctx->state[0] = C; + local.C = ctx->state[1] + local.C + local.Dp; + ctx->state[1] = ctx->state[2] + local.D + local.Ep; + ctx->state[2] = ctx->state[3] + local.E + local.Ap; + ctx->state[3] = ctx->state[4] + local.A + local.Bp; + ctx->state[4] = ctx->state[0] + local.B + local.Cp; + ctx->state[0] = local.C; /* Zeroise variables to clear sensitive data from memory. */ - mbedtls_zeroize( &A, sizeof( A ) ); - mbedtls_zeroize( &B, sizeof( B ) ); - mbedtls_zeroize( &C, sizeof( C ) ); - mbedtls_zeroize( &D, sizeof( D ) ); - mbedtls_zeroize( &E, sizeof( E ) ); - mbedtls_zeroize( &Ap, sizeof( Ap ) ); - mbedtls_zeroize( &Bp, sizeof( Bp ) ); - mbedtls_zeroize( &Cp, sizeof( Cp ) ); - mbedtls_zeroize( &Dp, sizeof( Dp ) ); - mbedtls_zeroize( &Ep, sizeof( Ep ) ); - mbedtls_zeroize( &X, sizeof( X ) ); + mbedtls_zeroize( &local, sizeof( local ) ); return( 0 ); } diff --git a/library/sha1.c b/library/sha1.c index 65841ee36..7e6981d5a 100644 --- a/library/sha1.c +++ b/library/sha1.c @@ -147,32 +147,37 @@ void mbedtls_sha1_starts( mbedtls_sha1_context *ctx ) int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, const unsigned char data[64] ) { - uint32_t temp, W[16], A, B, C, D, E; + struct + { + uint32_t temp, W[16], A, B, C, D, E; + } local; - GET_UINT32_BE( W[ 0], data, 0 ); - GET_UINT32_BE( W[ 1], data, 4 ); - GET_UINT32_BE( W[ 2], data, 8 ); - GET_UINT32_BE( W[ 3], data, 12 ); - GET_UINT32_BE( W[ 4], data, 16 ); - GET_UINT32_BE( W[ 5], data, 20 ); - GET_UINT32_BE( W[ 6], data, 24 ); - GET_UINT32_BE( W[ 7], data, 28 ); - GET_UINT32_BE( W[ 8], data, 32 ); - GET_UINT32_BE( W[ 9], data, 36 ); - GET_UINT32_BE( W[10], data, 40 ); - GET_UINT32_BE( W[11], data, 44 ); - GET_UINT32_BE( W[12], data, 48 ); - GET_UINT32_BE( W[13], data, 52 ); - GET_UINT32_BE( W[14], data, 56 ); - GET_UINT32_BE( W[15], data, 60 ); + GET_UINT32_BE( local.W[ 0], data, 0 ); + GET_UINT32_BE( local.W[ 1], data, 4 ); + GET_UINT32_BE( local.W[ 2], data, 8 ); + GET_UINT32_BE( local.W[ 3], data, 12 ); + GET_UINT32_BE( local.W[ 4], data, 16 ); + GET_UINT32_BE( local.W[ 5], data, 20 ); + GET_UINT32_BE( local.W[ 6], data, 24 ); + GET_UINT32_BE( local.W[ 7], data, 28 ); + GET_UINT32_BE( local.W[ 8], data, 32 ); + GET_UINT32_BE( local.W[ 9], data, 36 ); + GET_UINT32_BE( local.W[10], data, 40 ); + GET_UINT32_BE( local.W[11], data, 44 ); + GET_UINT32_BE( local.W[12], data, 48 ); + GET_UINT32_BE( local.W[13], data, 52 ); + GET_UINT32_BE( local.W[14], data, 56 ); + GET_UINT32_BE( local.W[15], data, 60 ); #define S(x,n) ((x << n) | ((x & 0xFFFFFFFF) >> (32 - n))) #define R(t) \ ( \ - temp = W[( t - 3 ) & 0x0F] ^ W[( t - 8 ) & 0x0F] ^ \ - W[( t - 14 ) & 0x0F] ^ W[ t & 0x0F], \ - ( W[t & 0x0F] = S(temp,1) ) \ + local.temp = local.W[( t - 3 ) & 0x0F] ^ \ + local.W[( t - 8 ) & 0x0F] ^ \ + local.W[( t - 14 ) & 0x0F] ^ \ + local.W[ t & 0x0F], \ + ( local.W[t & 0x0F] = S(local.temp,1) ) \ ) #define P(a,b,c,d,e,x) \ @@ -180,35 +185,35 @@ int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, e += S(a,5) + F(b,c,d) + K + x; b = S(b,30); \ } - A = ctx->state[0]; - B = ctx->state[1]; - C = ctx->state[2]; - D = ctx->state[3]; - E = ctx->state[4]; + local.A = ctx->state[0]; + local.B = ctx->state[1]; + local.C = ctx->state[2]; + local.D = ctx->state[3]; + local.E = ctx->state[4]; #define F(x,y,z) (z ^ (x & (y ^ z))) #define K 0x5A827999 - P( A, B, C, D, E, W[0] ); - P( E, A, B, C, D, W[1] ); - P( D, E, A, B, C, W[2] ); - P( C, D, E, A, B, W[3] ); - P( B, C, D, E, A, W[4] ); - P( A, B, C, D, E, W[5] ); - P( E, A, B, C, D, W[6] ); - P( D, E, A, B, C, W[7] ); - P( C, D, E, A, B, W[8] ); - P( B, C, D, E, A, W[9] ); - P( A, B, C, D, E, W[10] ); - P( E, A, B, C, D, W[11] ); - P( D, E, A, B, C, W[12] ); - P( C, D, E, A, B, W[13] ); - P( B, C, D, E, A, W[14] ); - P( A, B, C, D, E, W[15] ); - P( E, A, B, C, D, R(16) ); - P( D, E, A, B, C, R(17) ); - P( C, D, E, A, B, R(18) ); - P( B, C, D, E, A, R(19) ); + P( local.A, local.B, local.C, local.D, local.E, local.W[0] ); + P( local.E, local.A, local.B, local.C, local.D, local.W[1] ); + P( local.D, local.E, local.A, local.B, local.C, local.W[2] ); + P( local.C, local.D, local.E, local.A, local.B, local.W[3] ); + P( local.B, local.C, local.D, local.E, local.A, local.W[4] ); + P( local.A, local.B, local.C, local.D, local.E, local.W[5] ); + P( local.E, local.A, local.B, local.C, local.D, local.W[6] ); + P( local.D, local.E, local.A, local.B, local.C, local.W[7] ); + P( local.C, local.D, local.E, local.A, local.B, local.W[8] ); + P( local.B, local.C, local.D, local.E, local.A, local.W[9] ); + P( local.A, local.B, local.C, local.D, local.E, local.W[10] ); + P( local.E, local.A, local.B, local.C, local.D, local.W[11] ); + P( local.D, local.E, local.A, local.B, local.C, local.W[12] ); + P( local.C, local.D, local.E, local.A, local.B, local.W[13] ); + P( local.B, local.C, local.D, local.E, local.A, local.W[14] ); + P( local.A, local.B, local.C, local.D, local.E, local.W[15] ); + P( local.E, local.A, local.B, local.C, local.D, R(16) ); + P( local.D, local.E, local.A, local.B, local.C, R(17) ); + P( local.C, local.D, local.E, local.A, local.B, R(18) ); + P( local.B, local.C, local.D, local.E, local.A, R(19) ); #undef K #undef F @@ -216,26 +221,26 @@ int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, #define F(x,y,z) (x ^ y ^ z) #define K 0x6ED9EBA1 - P( A, B, C, D, E, R(20) ); - P( E, A, B, C, D, R(21) ); - P( D, E, A, B, C, R(22) ); - P( C, D, E, A, B, R(23) ); - P( B, C, D, E, A, R(24) ); - P( A, B, C, D, E, R(25) ); - P( E, A, B, C, D, R(26) ); - P( D, E, A, B, C, R(27) ); - P( C, D, E, A, B, R(28) ); - P( B, C, D, E, A, R(29) ); - P( A, B, C, D, E, R(30) ); - P( E, A, B, C, D, R(31) ); - P( D, E, A, B, C, R(32) ); - P( C, D, E, A, B, R(33) ); - P( B, C, D, E, A, R(34) ); - P( A, B, C, D, E, R(35) ); - P( E, A, B, C, D, R(36) ); - P( D, E, A, B, C, R(37) ); - P( C, D, E, A, B, R(38) ); - P( B, C, D, E, A, R(39) ); + P( local.A, local.B, local.C, local.D, local.E, R(20) ); + P( local.E, local.A, local.B, local.C, local.D, R(21) ); + P( local.D, local.E, local.A, local.B, local.C, R(22) ); + P( local.C, local.D, local.E, local.A, local.B, R(23) ); + P( local.B, local.C, local.D, local.E, local.A, R(24) ); + P( local.A, local.B, local.C, local.D, local.E, R(25) ); + P( local.E, local.A, local.B, local.C, local.D, R(26) ); + P( local.D, local.E, local.A, local.B, local.C, R(27) ); + P( local.C, local.D, local.E, local.A, local.B, R(28) ); + P( local.B, local.C, local.D, local.E, local.A, R(29) ); + P( local.A, local.B, local.C, local.D, local.E, R(30) ); + P( local.E, local.A, local.B, local.C, local.D, R(31) ); + P( local.D, local.E, local.A, local.B, local.C, R(32) ); + P( local.C, local.D, local.E, local.A, local.B, R(33) ); + P( local.B, local.C, local.D, local.E, local.A, R(34) ); + P( local.A, local.B, local.C, local.D, local.E, R(35) ); + P( local.E, local.A, local.B, local.C, local.D, R(36) ); + P( local.D, local.E, local.A, local.B, local.C, R(37) ); + P( local.C, local.D, local.E, local.A, local.B, R(38) ); + P( local.B, local.C, local.D, local.E, local.A, R(39) ); #undef K #undef F @@ -243,26 +248,26 @@ int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, #define F(x,y,z) ((x & y) | (z & (x | y))) #define K 0x8F1BBCDC - P( A, B, C, D, E, R(40) ); - P( E, A, B, C, D, R(41) ); - P( D, E, A, B, C, R(42) ); - P( C, D, E, A, B, R(43) ); - P( B, C, D, E, A, R(44) ); - P( A, B, C, D, E, R(45) ); - P( E, A, B, C, D, R(46) ); - P( D, E, A, B, C, R(47) ); - P( C, D, E, A, B, R(48) ); - P( B, C, D, E, A, R(49) ); - P( A, B, C, D, E, R(50) ); - P( E, A, B, C, D, R(51) ); - P( D, E, A, B, C, R(52) ); - P( C, D, E, A, B, R(53) ); - P( B, C, D, E, A, R(54) ); - P( A, B, C, D, E, R(55) ); - P( E, A, B, C, D, R(56) ); - P( D, E, A, B, C, R(57) ); - P( C, D, E, A, B, R(58) ); - P( B, C, D, E, A, R(59) ); + P( local.A, local.B, local.C, local.D, local.E, R(40) ); + P( local.E, local.A, local.B, local.C, local.D, R(41) ); + P( local.D, local.E, local.A, local.B, local.C, R(42) ); + P( local.C, local.D, local.E, local.A, local.B, R(43) ); + P( local.B, local.C, local.D, local.E, local.A, R(44) ); + P( local.A, local.B, local.C, local.D, local.E, R(45) ); + P( local.E, local.A, local.B, local.C, local.D, R(46) ); + P( local.D, local.E, local.A, local.B, local.C, R(47) ); + P( local.C, local.D, local.E, local.A, local.B, R(48) ); + P( local.B, local.C, local.D, local.E, local.A, R(49) ); + P( local.A, local.B, local.C, local.D, local.E, R(50) ); + P( local.E, local.A, local.B, local.C, local.D, R(51) ); + P( local.D, local.E, local.A, local.B, local.C, R(52) ); + P( local.C, local.D, local.E, local.A, local.B, R(53) ); + P( local.B, local.C, local.D, local.E, local.A, R(54) ); + P( local.A, local.B, local.C, local.D, local.E, R(55) ); + P( local.E, local.A, local.B, local.C, local.D, R(56) ); + P( local.D, local.E, local.A, local.B, local.C, R(57) ); + P( local.C, local.D, local.E, local.A, local.B, R(58) ); + P( local.B, local.C, local.D, local.E, local.A, R(59) ); #undef K #undef F @@ -270,44 +275,38 @@ int mbedtls_internal_sha1_process( mbedtls_sha1_context *ctx, #define F(x,y,z) (x ^ y ^ z) #define K 0xCA62C1D6 - P( A, B, C, D, E, R(60) ); - P( E, A, B, C, D, R(61) ); - P( D, E, A, B, C, R(62) ); - P( C, D, E, A, B, R(63) ); - P( B, C, D, E, A, R(64) ); - P( A, B, C, D, E, R(65) ); - P( E, A, B, C, D, R(66) ); - P( D, E, A, B, C, R(67) ); - P( C, D, E, A, B, R(68) ); - P( B, C, D, E, A, R(69) ); - P( A, B, C, D, E, R(70) ); - P( E, A, B, C, D, R(71) ); - P( D, E, A, B, C, R(72) ); - P( C, D, E, A, B, R(73) ); - P( B, C, D, E, A, R(74) ); - P( A, B, C, D, E, R(75) ); - P( E, A, B, C, D, R(76) ); - P( D, E, A, B, C, R(77) ); - P( C, D, E, A, B, R(78) ); - P( B, C, D, E, A, R(79) ); + P( local.A, local.B, local.C, local.D, local.E, R(60) ); + P( local.E, local.A, local.B, local.C, local.D, R(61) ); + P( local.D, local.E, local.A, local.B, local.C, R(62) ); + P( local.C, local.D, local.E, local.A, local.B, R(63) ); + P( local.B, local.C, local.D, local.E, local.A, R(64) ); + P( local.A, local.B, local.C, local.D, local.E, R(65) ); + P( local.E, local.A, local.B, local.C, local.D, R(66) ); + P( local.D, local.E, local.A, local.B, local.C, R(67) ); + P( local.C, local.D, local.E, local.A, local.B, R(68) ); + P( local.B, local.C, local.D, local.E, local.A, R(69) ); + P( local.A, local.B, local.C, local.D, local.E, R(70) ); + P( local.E, local.A, local.B, local.C, local.D, R(71) ); + P( local.D, local.E, local.A, local.B, local.C, R(72) ); + P( local.C, local.D, local.E, local.A, local.B, R(73) ); + P( local.B, local.C, local.D, local.E, local.A, R(74) ); + P( local.A, local.B, local.C, local.D, local.E, R(75) ); + P( local.E, local.A, local.B, local.C, local.D, R(76) ); + P( local.D, local.E, local.A, local.B, local.C, R(77) ); + P( local.C, local.D, local.E, local.A, local.B, R(78) ); + P( local.B, local.C, local.D, local.E, local.A, R(79) ); #undef K #undef F - ctx->state[0] += A; - ctx->state[1] += B; - ctx->state[2] += C; - ctx->state[3] += D; - ctx->state[4] += E; + ctx->state[0] += local.A; + ctx->state[1] += local.B; + ctx->state[2] += local.C; + ctx->state[3] += local.D; + ctx->state[4] += local.E; /* Zeroise buffers and variables to clear sensitive data from memory. */ - mbedtls_zeroize( &A, sizeof( A ) ); - mbedtls_zeroize( &B, sizeof( B ) ); - mbedtls_zeroize( &C, sizeof( C ) ); - mbedtls_zeroize( &D, sizeof( D ) ); - mbedtls_zeroize( &E, sizeof( E ) ); - mbedtls_zeroize( &W, sizeof( W ) ); - mbedtls_zeroize( &temp, sizeof( temp ) ); + mbedtls_zeroize( &local, sizeof( local ) ); return( 0 ); } diff --git a/library/sha256.c b/library/sha256.c index 9552b8ce4..9bbf69072 100644 --- a/library/sha256.c +++ b/library/sha256.c @@ -201,79 +201,100 @@ static const uint32_t K[] = #define F0(x,y,z) ((x & y) | (z & (x | y))) #define F1(x,y,z) (z ^ (x & (y ^ z))) -#define R(t) \ -( \ - W[t] = S1(W[t - 2]) + W[t - 7] + \ - S0(W[t - 15]) + W[t - 16] \ +#define R(t) \ +( \ + local.W[t] = S1(local.W[t - 2]) + local.W[t - 7] + \ + S0(local.W[t - 15]) + local.W[t - 16] \ ) -#define P(a,b,c,d,e,f,g,h,x,K) \ -{ \ - temp1 = h + S3(e) + F1(e,f,g) + K + x; \ - temp2 = S2(a) + F0(a,b,c); \ - d += temp1; h = temp1 + temp2; \ +#define P(a,b,c,d,e,f,g,h,x,K) \ +{ \ + local.temp1 = h + S3(e) + F1(e,f,g) + K + x; \ + local.temp2 = S2(a) + F0(a,b,c); \ + d += local.temp1; h = local.temp1 + local.temp2; \ } int mbedtls_internal_sha256_process( mbedtls_sha256_context *ctx, const unsigned char data[64] ) { - uint32_t temp1, temp2, W[64]; - uint32_t A[8]; + struct + { + uint32_t temp1, temp2, W[64]; + uint32_t A[8]; + } local; + unsigned int i; for( i = 0; i < 8; i++ ) - A[i] = ctx->state[i]; + local.A[i] = ctx->state[i]; #if defined(MBEDTLS_SHA256_SMALLER) for( i = 0; i < 64; i++ ) { if( i < 16 ) - GET_UINT32_BE( W[i], data, 4 * i ); + GET_UINT32_BE( local.W[i], data, 4 * i ); else R( i ); - P( A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], W[i], K[i] ); + P( local.A[0], local.A[1], local.A[2], local.A[3], local.A[4], + local.A[5], local.A[6], local.A[7], local.W[i], K[i] ); - temp1 = A[7]; A[7] = A[6]; A[6] = A[5]; A[5] = A[4]; A[4] = A[3]; - A[3] = A[2]; A[2] = A[1]; A[1] = A[0]; A[0] = temp1; + local.temp1 = local.A[7]; local.A[7] = local.A[6]; + local.A[6] = local.A[5]; local.A[5] = local.A[4]; + local.A[4] = local.A[3]; local.A[3] = local.A[2]; + local.A[2] = local.A[1]; local.A[1] = local.A[0]; + local.A[0] = local.temp1; } #else /* MBEDTLS_SHA256_SMALLER */ for( i = 0; i < 16; i++ ) - GET_UINT32_BE( W[i], data, 4 * i ); + GET_UINT32_BE( local.W[i], data, 4 * i ); for( i = 0; i < 16; i += 8 ) { - P( A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], W[i+0], K[i+0] ); - P( A[7], A[0], A[1], A[2], A[3], A[4], A[5], A[6], W[i+1], K[i+1] ); - P( A[6], A[7], A[0], A[1], A[2], A[3], A[4], A[5], W[i+2], K[i+2] ); - P( A[5], A[6], A[7], A[0], A[1], A[2], A[3], A[4], W[i+3], K[i+3] ); - P( A[4], A[5], A[6], A[7], A[0], A[1], A[2], A[3], W[i+4], K[i+4] ); - P( A[3], A[4], A[5], A[6], A[7], A[0], A[1], A[2], W[i+5], K[i+5] ); - P( A[2], A[3], A[4], A[5], A[6], A[7], A[0], A[1], W[i+6], K[i+6] ); - P( A[1], A[2], A[3], A[4], A[5], A[6], A[7], A[0], W[i+7], K[i+7] ); + P( local.A[0], local.A[1], local.A[2], local.A[3], local.A[4], + local.A[5], local.A[6], local.A[7], local.W[i+0], K[i+0] ); + P( local.A[7], local.A[0], local.A[1], local.A[2], local.A[3], + local.A[4], local.A[5], local.A[6], local.W[i+1], K[i+1] ); + P( local.A[6], local.A[7], local.A[0], local.A[1], local.A[2], + local.A[3], local.A[4], local.A[5], local.W[i+2], K[i+2] ); + P( local.A[5], local.A[6], local.A[7], local.A[0], local.A[1], + local.A[2], local.A[3], local.A[4], local.W[i+3], K[i+3] ); + P( local.A[4], local.A[5], local.A[6], local.A[7], local.A[0], + local.A[1], local.A[2], local.A[3], local.W[i+4], K[i+4] ); + P( local.A[3], local.A[4], local.A[5], local.A[6], local.A[7], + local.A[0], local.A[1], local.A[2], local.W[i+5], K[i+5] ); + P( local.A[2], local.A[3], local.A[4], local.A[5], local.A[6], + local.A[7], local.A[0], local.A[1], local.W[i+6], K[i+6] ); + P( local.A[1], local.A[2], local.A[3], local.A[4], local.A[5], + local.A[6], local.A[7], local.A[0], local.W[i+7], K[i+7] ); } for( i = 16; i < 64; i += 8 ) { - P( A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7], R(i+0), K[i+0] ); - P( A[7], A[0], A[1], A[2], A[3], A[4], A[5], A[6], R(i+1), K[i+1] ); - P( A[6], A[7], A[0], A[1], A[2], A[3], A[4], A[5], R(i+2), K[i+2] ); - P( A[5], A[6], A[7], A[0], A[1], A[2], A[3], A[4], R(i+3), K[i+3] ); - P( A[4], A[5], A[6], A[7], A[0], A[1], A[2], A[3], R(i+4), K[i+4] ); - P( A[3], A[4], A[5], A[6], A[7], A[0], A[1], A[2], R(i+5), K[i+5] ); - P( A[2], A[3], A[4], A[5], A[6], A[7], A[0], A[1], R(i+6), K[i+6] ); - P( A[1], A[2], A[3], A[4], A[5], A[6], A[7], A[0], R(i+7), K[i+7] ); + P( local.A[0], local.A[1], local.A[2], local.A[3], local.A[4], + local.A[5], local.A[6], local.A[7], R(i+0), K[i+0] ); + P( local.A[7], local.A[0], local.A[1], local.A[2], local.A[3], + local.A[4], local.A[5], local.A[6], R(i+1), K[i+1] ); + P( local.A[6], local.A[7], local.A[0], local.A[1], local.A[2], + local.A[3], local.A[4], local.A[5], R(i+2), K[i+2] ); + P( local.A[5], local.A[6], local.A[7], local.A[0], local.A[1], + local.A[2], local.A[3], local.A[4], R(i+3), K[i+3] ); + P( local.A[4], local.A[5], local.A[6], local.A[7], local.A[0], + local.A[1], local.A[2], local.A[3], R(i+4), K[i+4] ); + P( local.A[3], local.A[4], local.A[5], local.A[6], local.A[7], + local.A[0], local.A[1], local.A[2], R(i+5), K[i+5] ); + P( local.A[2], local.A[3], local.A[4], local.A[5], local.A[6], + local.A[7], local.A[0], local.A[1], R(i+6), K[i+6] ); + P( local.A[1], local.A[2], local.A[3], local.A[4], local.A[5], + local.A[6], local.A[7], local.A[0], R(i+7), K[i+7] ); } #endif /* MBEDTLS_SHA256_SMALLER */ for( i = 0; i < 8; i++ ) - ctx->state[i] += A[i]; + ctx->state[i] += local.A[i]; /* Zeroise buffers and variables to clear sensitive data from memory. */ - mbedtls_zeroize( &A, sizeof( A ) ); - mbedtls_zeroize( &W, sizeof( W ) ); - mbedtls_zeroize( &temp1, sizeof( temp1 ) ); - mbedtls_zeroize( &temp2, sizeof( temp2 ) ); + mbedtls_zeroize( &local, sizeof( local ) ); return( 0 ); } diff --git a/library/sha512.c b/library/sha512.c index 9e9f07359..fdd4ec9d7 100644 --- a/library/sha512.c +++ b/library/sha512.c @@ -235,8 +235,11 @@ int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, const unsigned char data[128] ) { int i; - uint64_t temp1, temp2, W[80]; - uint64_t A, B, C, D, E, F, G, H; + struct + { + uint64_t temp1, temp2, W[80]; + uint64_t A, B, C, D, E, F, G, H; + } local; #define SHR(x,n) (x >> n) #define ROTR(x,n) (SHR(x,n) | (x << (64 - n))) @@ -250,68 +253,66 @@ int mbedtls_internal_sha512_process( mbedtls_sha512_context *ctx, #define F0(x,y,z) ((x & y) | (z & (x | y))) #define F1(x,y,z) (z ^ (x & (y ^ z))) -#define P(a,b,c,d,e,f,g,h,x,K) \ -{ \ - temp1 = h + S3(e) + F1(e,f,g) + K + x; \ - temp2 = S2(a) + F0(a,b,c); \ - d += temp1; h = temp1 + temp2; \ +#define P(a,b,c,d,e,f,g,h,x,K) \ +{ \ + local.temp1 = h + S3(e) + F1(e,f,g) + K + x; \ + local.temp2 = S2(a) + F0(a,b,c); \ + d += local.temp1; h = local.temp1 + local.temp2; \ } for( i = 0; i < 16; i++ ) { - GET_UINT64_BE( W[i], data, i << 3 ); + GET_UINT64_BE( local.W[i], data, i << 3 ); } for( ; i < 80; i++ ) { - W[i] = S1(W[i - 2]) + W[i - 7] + - S0(W[i - 15]) + W[i - 16]; + local.W[i] = S1(local.W[i - 2]) + local.W[i - 7] + + S0(local.W[i - 15]) + local.W[i - 16]; } - A = ctx->state[0]; - B = ctx->state[1]; - C = ctx->state[2]; - D = ctx->state[3]; - E = ctx->state[4]; - F = ctx->state[5]; - G = ctx->state[6]; - H = ctx->state[7]; + local.A = ctx->state[0]; + local.B = ctx->state[1]; + local.C = ctx->state[2]; + local.D = ctx->state[3]; + local.E = ctx->state[4]; + local.F = ctx->state[5]; + local.G = ctx->state[6]; + local.H = ctx->state[7]; i = 0; do { - P( A, B, C, D, E, F, G, H, W[i], K[i] ); i++; - P( H, A, B, C, D, E, F, G, W[i], K[i] ); i++; - P( G, H, A, B, C, D, E, F, W[i], K[i] ); i++; - P( F, G, H, A, B, C, D, E, W[i], K[i] ); i++; - P( E, F, G, H, A, B, C, D, W[i], K[i] ); i++; - P( D, E, F, G, H, A, B, C, W[i], K[i] ); i++; - P( C, D, E, F, G, H, A, B, W[i], K[i] ); i++; - P( B, C, D, E, F, G, H, A, W[i], K[i] ); i++; + P( local.A, local.B, local.C, local.D, local.E, + local.F, local.G, local.H, local.W[i], K[i] ); i++; + P( local.H, local.A, local.B, local.C, local.D, + local.E, local.F, local.G, local.W[i], K[i] ); i++; + P( local.G, local.H, local.A, local.B, local.C, + local.D, local.E, local.F, local.W[i], K[i] ); i++; + P( local.F, local.G, local.H, local.A, local.B, + local.C, local.D, local.E, local.W[i], K[i] ); i++; + P( local.E, local.F, local.G, local.H, local.A, + local.B, local.C, local.D, local.W[i], K[i] ); i++; + P( local.D, local.E, local.F, local.G, local.H, + local.A, local.B, local.C, local.W[i], K[i] ); i++; + P( local.C, local.D, local.E, local.F, local.G, + local.H, local.A, local.B, local.W[i], K[i] ); i++; + P( local.B, local.C, local.D, local.E, local.F, + local.G, local.H, local.A, local.W[i], K[i] ); i++; } while( i < 80 ); - ctx->state[0] += A; - ctx->state[1] += B; - ctx->state[2] += C; - ctx->state[3] += D; - ctx->state[4] += E; - ctx->state[5] += F; - ctx->state[6] += G; - ctx->state[7] += H; + ctx->state[0] += local.A; + ctx->state[1] += local.B; + ctx->state[2] += local.C; + ctx->state[3] += local.D; + ctx->state[4] += local.E; + ctx->state[5] += local.F; + ctx->state[6] += local.G; + ctx->state[7] += local.H; /* Zeroise buffers and variables to clear sensitive data from memory. */ - mbedtls_zeroize( &A, sizeof( A ) ); - mbedtls_zeroize( &B, sizeof( B ) ); - mbedtls_zeroize( &C, sizeof( C ) ); - mbedtls_zeroize( &D, sizeof( D ) ); - mbedtls_zeroize( &E, sizeof( E ) ); - mbedtls_zeroize( &F, sizeof( F ) ); - mbedtls_zeroize( &G, sizeof( G ) ); - mbedtls_zeroize( &H, sizeof( H ) ); - mbedtls_zeroize( &W, sizeof( W ) ); - mbedtls_zeroize( &temp1, sizeof( temp1 ) ); - mbedtls_zeroize( &temp2, sizeof( temp2 ) ); + mbedtls_zeroize( &local, sizeof( local ) ); return( 0 ); } From c0a5b254e79ce9e29132c80e85f4290b9fd2a0c0 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 25 Nov 2020 15:37:20 +0100 Subject: [PATCH 05/18] Test mbedtls_mpi_fill_random Positive tests: test that the RNG has the expected size, given that we know how many leading zeros it has because we know how the function consumes bytes and when the test RNG produces null bytes. Negative tests: test that if the RNG is willing to emit less than the number of wanted bytes, the function fails. Signed-off-by: Gilles Peskine --- tests/suites/test_suite_mpi.data | 42 ++++++++++++++++++++++++ tests/suites/test_suite_mpi.function | 48 ++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+) diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index a6a642306..8a25a9775 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -899,6 +899,48 @@ mbedtls_mpi_set_bit:16:"00":32:1:16:"0100000000":0 Test bit set (Invalid bit value) mbedtls_mpi_set_bit:16:"00":5:2:16:"00":MBEDTLS_ERR_MPI_BAD_INPUT_DATA +Fill random: 0 bytes +mpi_fill_random:0:0:0 + +Fill random: 1 byte, good +mpi_fill_random:1:1:0 + +Fill random: 2 bytes, good, no leading zero +mpi_fill_random:2:2:0 + +Fill random: 2 bytes, good, 1 leading zero +mpi_fill_random:2:256:0 + +Fill random: MAX_SIZE - 7, good +mpi_fill_random:MBEDTLS_MPI_MAX_SIZE - 7:MBEDTLS_MPI_MAX_SIZE - 7:0 + +Fill random: MAX_SIZE, good +mpi_fill_random:MBEDTLS_MPI_MAX_SIZE:MBEDTLS_MPI_MAX_SIZE:0 + +Fill random: 1 byte, RNG failure +mpi_fill_random:1:0:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: 2 bytes, RNG failure after 1 byte +mpi_fill_random:2:1:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: 4 bytes, RNG failure after 3 bytes +mpi_fill_random:4:3:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: 8 bytes, RNG failure after 7 bytes +mpi_fill_random:8:7:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: 16 bytes, RNG failure after 1 bytes +mpi_fill_random:16:1:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: 16 bytes, RNG failure after 8 bytes +mpi_fill_random:16:8:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: 16 bytes, RNG failure after 15 bytes +mpi_fill_random:16:15:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + +Fill random: MAX_SIZE bytes, RNG failure after MAX_SIZE-1 bytes +mpi_fill_random:MBEDTLS_MPI_MAX_SIZE:MBEDTLS_MPI_MAX_SIZE-1:MBEDTLS_ERR_ENTROPY_SOURCE_FAILED + MPI Selftest depends_on:MBEDTLS_SELF_TEST mpi_selftest: diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function index 6f5abf3b8..7cd279bd4 100644 --- a/tests/suites/test_suite_mpi.function +++ b/tests/suites/test_suite_mpi.function @@ -1,5 +1,6 @@ /* BEGIN_HEADER */ #include "mbedtls/bignum.h" +#include "mbedtls/entropy.h" typedef struct mbedtls_test_mpi_random { @@ -44,6 +45,22 @@ int mbedtls_test_mpi_miller_rabin_determinizer( void* state, return( 0 ); } + +/* Random generator that is told how many bytes to return. */ +static int f_rng_bytes_left( void *state, unsigned char *buf, size_t len ) +{ + size_t *bytes_left = state; + size_t i; + for( i = 0; i < len; i++ ) + { + if( *bytes_left == 0 ) + return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED ); + buf[i] = *bytes_left & 0xff; + --( *bytes_left ); + } + return( 0 ); +} + /* END_HEADER */ /* BEGIN_DEPENDENCIES @@ -1037,6 +1054,37 @@ exit: } /* END_CASE */ +/* BEGIN_CASE */ +void mpi_fill_random( int wanted_bytes, int rng_bytes, int expected_ret ) +{ + mbedtls_mpi X; + int ret; + size_t bytes_left = rng_bytes; + mbedtls_mpi_init( &X ); + + ret = mbedtls_mpi_fill_random( &X, wanted_bytes, + f_rng_bytes_left, &bytes_left ); + TEST_ASSERT( ret == expected_ret ); + + if( expected_ret == 0 ) + { + /* mbedtls_mpi_fill_random is documented to use bytes from the RNG + * as a big-endian representation of the number. We know when + * our RNG function returns null bytes, so we know how many + * leading zero bytes the number has. */ + size_t leading_zeros = 0; + if( wanted_bytes > 0 && rng_bytes % 256 == 0 ) + leading_zeros = 1; + TEST_ASSERT( mbedtls_mpi_size( &X ) + leading_zeros == + (size_t) wanted_bytes ); + TEST_ASSERT( (int) bytes_left == rng_bytes - wanted_bytes ); + } + +exit: + mbedtls_mpi_free( &X ); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */ void mpi_selftest() { From 5af02ce55b90d94a477446fce426cded8f7b431d Mon Sep 17 00:00:00 2001 From: Paul Elliott Date: Wed, 2 Dec 2020 15:56:03 +0000 Subject: [PATCH 06/18] Add tag check to cert algorithm check Add missing tag check for algorithm parameters when comparing the signature in the description part of the cert against the actual signature whilst loading a certificate. This was found by a certificate (created by fuzzing) that openssl would not verify, but mbedtls would. Regression test added (one of the client certs modified accordingly) Signed-off-by: Paul Elliott --- .../x509-add-tag-check-to-algorithm-params | 11 +++++++++++ library/x509_crt.c | 1 + tests/data_files/Makefile | 8 ++++++++ tests/data_files/cli-rsa-sha256-badalg.crt.der | Bin 0 -> 905 bytes tests/suites/test_suite_x509parse.data | 4 ++++ 5 files changed, 24 insertions(+) create mode 100644 ChangeLog.d/x509-add-tag-check-to-algorithm-params create mode 100644 tests/data_files/cli-rsa-sha256-badalg.crt.der diff --git a/ChangeLog.d/x509-add-tag-check-to-algorithm-params b/ChangeLog.d/x509-add-tag-check-to-algorithm-params new file mode 100644 index 000000000..f2c72b0ec --- /dev/null +++ b/ChangeLog.d/x509-add-tag-check-to-algorithm-params @@ -0,0 +1,11 @@ +Security + * Fix a compliance issue whereby we were not checking the tag on the + algorithm parameters (only the size) when comparing the signature in the + description part of the cert to the real signature. This meant that a + NULL algorithm parameters entry would look identical to an array of REAL + (size zero) to the library and thus the certificate would be considered + valid. However, if the parameters do not match in *any* way then the + certificate should be considered invalid, and indeed OpenSSL marks these + certs as invalid when mbedtls did not. + Many thanks to guidovranken who found this issue via differential fuzzing + and reported it in #3629. diff --git a/library/x509_crt.c b/library/x509_crt.c index acda1f22c..2334a35dc 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -929,6 +929,7 @@ static int x509_crt_parse_der_core( mbedtls_x509_crt *crt, const unsigned char * if( crt->sig_oid.len != sig_oid2.len || memcmp( crt->sig_oid.p, sig_oid2.p, crt->sig_oid.len ) != 0 || + sig_params1.tag != sig_params2.tag || sig_params1.len != sig_params2.len || ( sig_params1.len != 0 && memcmp( sig_params1.p, sig_params2.p, sig_params1.len ) != 0 ) ) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 61edad1d4..d76aa5d7f 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -129,6 +129,14 @@ cli-rsa-sha256.crt: $(cli_crt_key_file_rsa) test-ca-sha256.crt cli-rsa.csr $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa -CA test-ca-sha256.crt -CAkey $(test_ca_key_file_rsa) -passin "pass:$(test_ca_pwd_rsa)" -set_serial 4 -days 3653 -sha256 -in cli-rsa.csr -out $@ all_final += cli-rsa-sha256.crt +cli-rsa-sha256.crt.der: cli-rsa-sha256.crt + $(OPENSSL) x509 -in $< -out $@ -inform PEM -outform DER +all_final += cli-rsa-sha256.crt.der + +cli-rsa-sha256-badalg.crt.der: cli-rsa-sha256.crt.der + hexdump -ve '1/1 "%.2X"' $< | sed "s/06092A864886F70D01010B0500/06092A864886F70D01010B0900/2" | xxd -r -p > $@ +all_final += cli-rsa-sha256-badalg.crt.der + server2-rsa.csr: server2.key $(OPENSSL) req -new -key server2.key -passin "pass:$(test_ca_pwd_rsa)" -subj "/C=NL/O=PolarSSL/CN=localhost" -out $@ all_intermediate += server2-rsa.csr diff --git a/tests/data_files/cli-rsa-sha256-badalg.crt.der b/tests/data_files/cli-rsa-sha256-badalg.crt.der new file mode 100644 index 0000000000000000000000000000000000000000..be75255ac3f2a326cab22bc556736410a378c851 GIT binary patch literal 905 zcmXqLVs15PV#-~>%*4pV#K>a6%f_kI=F#?@mywa1mBGN;klTQhjX9KsO_<5g$57CK zAH?C};RwjjNh}Hu_A!(+5C;h{^9aC%6hcyqOB9?P4dldmjSLKp42%qoje&HOI4_7Y zFotpsYzP`IWgr1DTo7)!b53SzUWtN{K@+1AvTGSx8JL?G`5A!XTue=jj0`7Aj-1)~ zb8F>G*P9{<8)|n?{*)~@-*_!=f0s>I>eD+eH_xQCvS0n7zQN1%Lh?MWJn8MXKGdy# z$0IPg%~QhU^9rp?;a~Nx=$C7@B>FZ5^e><4QSdd-chgnj!P4{bmKjkU^|Hkk@MgRUo z^{3Y6C|>Km*`3vw|6ukHfv_{1`-DZGnXsfCfA`ajFKg;I&RJ~fUs4NyoLaI`^}#=z zZc~=@T@U=rTL0AlG0Wci@~kd%lHX=qhV$#o7G#DsXI)xx<#|Biv#n;V<*d2YC!QSn z>vL5xo{5=}fpKx;B!k9&16g1w%JQ*@v4|8dWGF6j&<`n#GyW6QzvtuKY&S)NWRSEn zON>EOgUFVsCrdZqyAT4m=R#U9I$`qNV$ed)#!EJND)`e3wYQy}%o$>DM3haF<=( zG8L=RI1`Dr;&0u;bPB$e96ETRe6ES4V@my*y0A0JL0gsONI~*C9;@ymxo9Osc#S5%Xm{`=8NYwQ{+Ccm~rLoj1qx8 zcfOV6^L#MWyYO;_#~RP41})zLwXDBcE5tp_^8eGqEaz0^^utlt%T49g;aLjWS~kN^Mx literal 0 HcmV?d00001 diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index b87859ec6..97eeac87f 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -1864,6 +1864,10 @@ X509 File parse (trailing spaces, OK) depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C:MBEDTLS_RSA_C x509parse_crt_file:"data_files/server7_trailing_space.crt":0 +X509 File parse (Algorithm Params Tag mismatch) +depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C +x509parse_crt_file:"data_files/cli-rsa-sha256-badalg.crt.der":MBEDTLS_ERR_X509_SIG_MISMATCH + X509 Get time (UTC no issues) depends_on:MBEDTLS_X509_USE_C x509_get_time:MBEDTLS_ASN1_UTC_TIME:"500101000000Z":0:1950:1:1:0:0:0 From 8b1f65ea00d2cb444f63bf436ebee917ef7ee87a Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Wed, 25 Nov 2020 15:12:39 +0000 Subject: [PATCH 07/18] Fix potential DoS by limiting number sizes in exponentiation Check that the exponent and modulus is below `MBEDTLS_MPI_MAX_BITS` before performing a time expensive operation (modular exponentiation). This prevents a potential DoS from Diffie-Hellman computations with extremely large key sizes. Signed-off-by: Chris Jones --- library/bignum.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/library/bignum.c b/library/bignum.c index 3135ec4ad..ba4bb831f 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -1859,6 +1859,10 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi if( mbedtls_mpi_cmp_int( E, 0 ) < 0 ) return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); + if( mbedtls_mpi_bitlen( E ) > MBEDTLS_MPI_MAX_BITS || + mbedtls_mpi_bitlen( N ) > MBEDTLS_MPI_MAX_BITS ) + return ( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); + /* * Init temps and window size */ From 8c650f985d09dfadd8b80c462c8911e8a8266325 Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 26 Nov 2020 11:21:53 +0000 Subject: [PATCH 08/18] Test that overly large Diffie-Hellman keys are rejected Add a test case to ensure `mbedtls_mpi_exp_mod` fails when using a key size larger than MBEDTLS_MPI_MAX_SIZE. Add a test case to ensure that Diffie-Hellman operations fail when using a key size larger than MBEDTLS_MPI_MAX_SIZE. Signed-off-by: Chris Jones --- tests/suites/test_suite_dhm.data | 7 +++++-- tests/suites/test_suite_mpi.data | 5 ++++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_dhm.data b/tests/suites/test_suite_dhm.data index 734fd97ac..64f0ca306 100644 --- a/tests/suites/test_suite_dhm.data +++ b/tests/suites/test_suite_dhm.data @@ -19,10 +19,13 @@ dhm_do_dhm:10:"3":10:"5":MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED Diffie-Hellman zero modulus dhm_do_dhm:10:"0":10:"5":MBEDTLS_ERR_DHM_BAD_INPUT_DATA -Diffie-Hellman load parameters from file +Diffie-Hellman huge modulus +dhm_do_dhm:16:"50000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70d01010505003045310b3009060355040e130241553113301106035504080c0a536f6d654853746174653121301f060355040a0c18496e7465726e6574205769646769747320507479204c7464301e170d3134303732333230353034305a170d3137303432323230353034305a3045310b3009060355042e130241553113301106035574080c0a136f6d652d53746174653121301f06035504050c18496e7465726e6574205769646769747320507479204c746430819f300d06092a864886f70d010101050003818d003081890281816602ffffff9e000000000000020000bf1400000000000100000000000000feffef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e1e1e001e1e1e1e1e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000040ffd0100010000160000000000000000000000000000ff00000008000000000000000000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70dc9784adc17e9e82f4cadccc1747090a92f8ca6840c0f404db671d219301706035504031310506f6c617253534c205465737420434130820122300d06092a864886f70d0101010500038201160303005b02000057030367c6699151ff4aec29cdbaabf2fbe3467cc254f81be8e78d765a2e63339fc99a2009fc99a2066310db7315864fc99a2066320db73058a3ff7f00001758e942d4abb2cdc64e9bb43ddc87c03db1b28d17e02cb23":10:"5":MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED+MBEDTLS_ERR_MPI_BAD_INPUT_DATA + +Diffie-Hellman load parameters from file [#1] dhm_file:"data_files/dhparams.pem":"9e35f430443a09904f3a39a979797d070df53378e79c2438bef4e761f3c714553328589b041c809be1d6c6b5f1fc9f47d3a25443188253a992a56818b37ba9de5a40d362e56eff0be5417474c125c199272c8fe41dea733df6f662c92ae76556e755d10c64e6a50968f67fc6ea73d0dca8569be2ba204e23580d8bca2f4975b3":"02":128 -Diffie-Hellman load parameters from file +Diffie-Hellman load parameters from file [#2] dhm_file:"data_files/dh.optlen.pem":"b3126aeaf47153c7d67f403030b292b5bd5a6c9eae1c137af34087fce2a36a578d70c5c560ad2bdb924c4a4dbee20a1671be7103ce87defa76908936803dbeca60c33e1289c1a03ac2c6c4e49405e5902fa0596a1cbaa895cc402d5213ed4a5f1f5ba8b5e1ed3da951a4c475afeb0ca660b7368c38c8e809f382d96ae19e60dc984e61cb42b5dfd723322acf327f9e413cda6400c15c5b2ea1fa34405d83982fba40e6d852da3d91019bf23511314254dc211a90833e5b1798ee52a78198c555644729ad92f060367c74ded37704adfc273a4a33fec821bd2ebd3bc051730e97a4dd14d2b766062592f5eec09d16bb50efebf2cc00dd3e0e3418e60ec84870f7":"800abfe7dc667aa17bcd7c04614bc221a65482ccc04b604602b0e131908a938ea11b48dc515dab7abcbb1e0c7fd66511edc0d86551b7632496e03df94357e1c4ea07a7ce1e381a2fcafdff5f5bf00df828806020e875c00926e4d011f88477a1b01927d73813cad4847c6396b9244621be2b00b63c659253318413443cd244215cd7fd4cbe796e82c6cf70f89cc0c528fb8e344809b31876e7ef739d5160d095c9684188b0c8755c7a468d47f56d6db9ea012924ecb0556fb71312a8d7c93bb2898ea08ee54eeb594548285f06a973cbbe2a0cb02e90f323fe045521f34c68354a6d3e95dbfff1eb64692edc0a44f3d3e408d0e479a541e779a6054259e2d854":256 Diffie-Hellman selftest diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index a6a642306..6764359fe 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -673,9 +673,12 @@ mbedtls_mpi_exp_mod:10:"-23":10:"13":10:"29":10:"":10:"5":0 Base test mbedtls_mpi_exp_mod #5 (Negative exponent) mbedtls_mpi_exp_mod:10:"23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA -Base test mbedtls_mpi_exp_mod #7 (Negative base + exponent) +Base test mbedtls_mpi_exp_mod #6 (Negative base + exponent) mbedtls_mpi_exp_mod:10:"-23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA +Base test mbedtls_mpi_exp_mod #7 (Huge exponent) +mbedtls_mpi_exp_mod:10:"23":16:"50000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70d01010505003045310b3009060355040e130241553113301106035504080c0a536f6d654853746174653121301f060355040a0c18496e7465726e6574205769646769747320507479204c7464301e170d3134303732333230353034305a170d3137303432323230353034305a3045310b3009060355042e130241553113301106035574080c0a136f6d652d53746174653121301f06035504050c18496e7465726e6574205769646769747320507479204c746430819f300d06092a864886f70d010101050003818d003081890281816602ffffff9e000000000000020000bf1400000000000100000000000000feffef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e1e1e001e1e1e1e1e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000040ffd0100010000160000000000000000000000000000ff00000008000000000000000000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70dc9784adc17e9e82f4cadccc1747090a92f8ca6840c0f404db671d219301706035504031310506f6c617253534c205465737420434130820122300d06092a864886f70d0101010500038201160303005b02000057030367c6699151ff4aec29cdbaabf2fbe3467cc254f81be8e78d765a2e63339fc99a2009fc99a2066310db7315864fc99a2066320db73058a3ff7f00001758e942d4abb2cdc64e9bb43ddc87c03db1b28d17e02cb23":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA + Test mbedtls_mpi_exp_mod #1 mbedtls_mpi_exp_mod:10:"433019240910377478217373572959560109819648647016096560523769010881172869083338285573756574557395862965095016483867813043663981946477698466501451832407592327356331263124555137732393938242285782144928753919588632679050799198937132922145084847":10:"5781538327977828897150909166778407659250458379645823062042492461576758526757490910073628008613977550546382774775570888130029763571528699574717583228939535960234464230882573615930384979100379102915657483866755371559811718767760594919456971354184113721":10:"583137007797276923956891216216022144052044091311388601652961409557516421612874571554415606746479105795833145583959622117418531166391184939066520869800857530421873250114773204354963864729386957427276448683092491947566992077136553066273207777134303397724679138833126700957":10:"":10:"114597449276684355144920670007147953232659436380163461553186940113929777196018164149703566472936578890991049344459204199888254907113495794730452699842273939581048142004834330369483813876618772578869083248061616444392091693787039636316845512292127097865026290173004860736":0 From 303e2f47d47b46fd4e17bd416f6a46c3c1a67c2a Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Mon, 30 Nov 2020 11:16:48 +0000 Subject: [PATCH 09/18] Add ChangeLog entry for modular exponentiation size limit Signed-off-by: Chris Jones --- ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt diff --git a/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt b/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt new file mode 100644 index 000000000..982b7bc2c --- /dev/null +++ b/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt @@ -0,0 +1,4 @@ +Security + * Limit the size of calculations performed by mbedtls_mpi_exp_mod to + MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when + generating Diffie-Hellman key pairs. Credit to OSS-Fuzz. \ No newline at end of file From 65ad4cff7be23bc34cde1403e81ca8685fc3045f Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Wed, 2 Dec 2020 10:41:50 +0000 Subject: [PATCH 10/18] Test that overly large Diffie-Hellman keys are rejected Adds test cases to ensure that `mbedtls_mpi_exp_mod` will return an error with an exponent or modulus that is greater than `MBEDTLS_MPI_MAX_SIZE` in size. Adds test cases to ensure that Diffie-Hellman will fail to make a key pair (using `mbedtls_dhm_make_public`) when the prime modulus is greater than `MBEDTLS_MPI_MAX_SIZE` in size. Signed-off-by: Chris Jones --- tests/suites/test_suite_dhm.data | 7 +++++-- tests/suites/test_suite_dhm.function | 30 +++++++++++++++++++++++++++ tests/suites/test_suite_mpi.data | 13 ++++++++++-- tests/suites/test_suite_mpi.function | 31 ++++++++++++++++++++++++++++ 4 files changed, 77 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_dhm.data b/tests/suites/test_suite_dhm.data index 64f0ca306..3b71c3569 100644 --- a/tests/suites/test_suite_dhm.data +++ b/tests/suites/test_suite_dhm.data @@ -19,8 +19,11 @@ dhm_do_dhm:10:"3":10:"5":MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED Diffie-Hellman zero modulus dhm_do_dhm:10:"0":10:"5":MBEDTLS_ERR_DHM_BAD_INPUT_DATA -Diffie-Hellman huge modulus -dhm_do_dhm:16:"50000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70d01010505003045310b3009060355040e130241553113301106035504080c0a536f6d654853746174653121301f060355040a0c18496e7465726e6574205769646769747320507479204c7464301e170d3134303732333230353034305a170d3137303432323230353034305a3045310b3009060355042e130241553113301106035574080c0a136f6d652d53746174653121301f06035504050c18496e7465726e6574205769646769747320507479204c746430819f300d06092a864886f70d010101050003818d003081890281816602ffffff9e000000000000020000bf1400000000000100000000000000feffef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e1e1e001e1e1e1e1e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000040ffd0100010000160000000000000000000000000000ff00000008000000000000000000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70dc9784adc17e9e82f4cadccc1747090a92f8ca6840c0f404db671d219301706035504031310506f6c617253534c205465737420434130820122300d06092a864886f70d0101010500038201160303005b02000057030367c6699151ff4aec29cdbaabf2fbe3467cc254f81be8e78d765a2e63339fc99a2009fc99a2066310db7315864fc99a2066320db73058a3ff7f00001758e942d4abb2cdc64e9bb43ddc87c03db1b28d17e02cb23":10:"5":MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED+MBEDTLS_ERR_MPI_BAD_INPUT_DATA +Diffie-Hellman MPI_MAX_SIZE modulus +dhm_make_public:MBEDTLS_MPI_MAX_SIZE:10:"5":0 + +Diffie-Hellman MPI_MAX_SIZE + 1 modulus +dhm_make_public:MBEDTLS_MPI_MAX_SIZE + 1:10:"5":MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED+MBEDTLS_ERR_MPI_BAD_INPUT_DATA Diffie-Hellman load parameters from file [#1] dhm_file:"data_files/dhparams.pem":"9e35f430443a09904f3a39a979797d070df53378e79c2438bef4e761f3c714553328589b041c809be1d6c6b5f1fc9f47d3a25443188253a992a56818b37ba9de5a40d362e56eff0be5417474c125c199272c8fe41dea733df6f662c92ae76556e755d10c64e6a50968f67fc6ea73d0dca8569be2ba204e23580d8bca2f4975b3":"02":128 diff --git a/tests/suites/test_suite_dhm.function b/tests/suites/test_suite_dhm.function index 4fd8fff23..2d1ef26f7 100644 --- a/tests/suites/test_suite_dhm.function +++ b/tests/suites/test_suite_dhm.function @@ -99,6 +99,36 @@ exit: } /* END_CASE */ +/* BEGIN_CASE */ +void dhm_make_public( int P_bytes, int radix_G, char *input_G, int result ) +{ + mbedtls_mpi P, G; + mbedtls_dhm_context ctx; + unsigned char output[MBEDTLS_MPI_MAX_SIZE]; + + mbedtls_mpi_init( &P ); + mbedtls_mpi_init( &G ); + mbedtls_dhm_init( &ctx ); + + TEST_ASSERT( mbedtls_mpi_lset( &P, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_shift_l( &P, ( P_bytes * 8 ) - 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_set_bit( &P, 0, 1 ) == 0 ); + + TEST_ASSERT( mbedtls_mpi_read_string( &G, radix_G, input_G ) == 0 ); + + TEST_ASSERT( mbedtls_dhm_set_group( &ctx, &P, &G ) == 0 ); + TEST_ASSERT( mbedtls_dhm_make_public( &ctx, (int) mbedtls_mpi_size( &P ), + output, sizeof(output), + &mbedtls_test_rnd_pseudo_rand, + NULL ) == result ); + +exit: + mbedtls_mpi_free( &P ); + mbedtls_mpi_free( &G ); + mbedtls_dhm_free( &ctx ); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_FS_IO */ void dhm_file( char *filename, char *p, char *g, int len ) { diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index 6764359fe..5ac0d6d43 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -676,8 +676,17 @@ mbedtls_mpi_exp_mod:10:"23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_IN Base test mbedtls_mpi_exp_mod #6 (Negative base + exponent) mbedtls_mpi_exp_mod:10:"-23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA -Base test mbedtls_mpi_exp_mod #7 (Huge exponent) -mbedtls_mpi_exp_mod:10:"23":16:"50000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70d01010505003045310b3009060355040e130241553113301106035504080c0a536f6d654853746174653121301f060355040a0c18496e7465726e6574205769646769747320507479204c7464301e170d3134303732333230353034305a170d3137303432323230353034305a3045310b3009060355042e130241553113301106035574080c0a136f6d652d53746174653121301f06035504050c18496e7465726e6574205769646769747320507479204c746430819f300d06092a864886f70d010101050003818d003081890281816602ffffff9e000000000000020000bf1400000000000100000000000000feffef00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e1e1e001e1e1e1e1e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000040ffd0100010000160000000000000000000000000000ff00000008000000000000000000000000000000000000000000000000000000000000000000000100014e4c3111300f060355040a13086f53534c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b810400224ee06ec30e5753333958e280a8000000809539c2885280afd66aab21ddb8d31c6e58b8cae8b2698ef341ad29c3b45f75a7476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f00476fd5192955699a533b20b4661660341e00000040000000160000000000001604149d316d202449023f2bcb78b519bc7fffc9cbfb357c316e0603cdcdcdcd0ba34677b8b3be2c3633023100fdbfff7b67df9d7b7f7f000000000001000400000000000000506f6c617253530000000000000000000000000000000000000000110000f6de000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c323536193017060000004f000000000000000000000005000000000000000000000000001603030039020000350303cf02020244e8786d95de3d020202e101f2f34e75c8b70a610e44c1000000000000008400000d00a30000ff60010001000016000016030102660b00026200025f00025c30820258308201c1a003020102020900fbb04c2eab109b0c300d06092a864886f70dc9784adc17e9e82f4cadccc1747090a92f8ca6840c0f404db671d219301706035504031310506f6c617253534c205465737420434130820122300d06092a864886f70d0101010500038201160303005b02000057030367c6699151ff4aec29cdbaabf2fbe3467cc254f81be8e78d765a2e63339fc99a2009fc99a2066310db7315864fc99a2066320db73058a3ff7f00001758e942d4abb2cdc64e9bb43ddc87c03db1b28d17e02cb23":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA +Base test mbedtls_mpi_exp_mod #7 (MAX_SIZE exponent) +mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE:2:10:"":0 + +Base test mbedtls_mpi_exp_mod #8 (MAX_SIZE + 1 exponent) +mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:2:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA + +Base test mbedtls_mpi_exp_mod #9 (MAX_SIZE modulus) +mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE:10:"":0 + +Base test mbedtls_mpi_exp_mod #10 (MAX_SIZE + 1 modulus) +mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA Test mbedtls_mpi_exp_mod #1 mbedtls_mpi_exp_mod:10:"433019240910377478217373572959560109819648647016096560523769010881172869083338285573756574557395862965095016483867813043663981946477698466501451832407592327356331263124555137732393938242285782144928753919588632679050799198937132922145084847":10:"5781538327977828897150909166778407659250458379645823062042492461576758526757490910073628008613977550546382774775570888130029763571528699574717583228939535960234464230882573615930384979100379102915657483866755371559811718767760594919456971354184113721":10:"583137007797276923956891216216022144052044091311388601652961409557516421612874571554415606746479105795833145583959622117418531166391184939066520869800857530421873250114773204354963864729386957427276448683092491947566992077136553066273207777134303397724679138833126700957":10:"":10:"114597449276684355144920670007147953232659436380163461553186940113929777196018164149703566472936578890991049344459204199888254907113495794730452699842273939581048142004834330369483813876618772578869083248061616444392091693787039636316845512292127097865026290173004860736":0 diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function index 6f5abf3b8..d1a96b68a 100644 --- a/tests/suites/test_suite_mpi.function +++ b/tests/suites/test_suite_mpi.function @@ -899,6 +899,37 @@ exit: } /* END_CASE */ +/* BEGIN_CASE */ +void mbedtls_mpi_exp_mod_size( int A_bytes, int E_bytes, int N_bytes, + int radix_RR, char * input_RR, int div_result ) +{ + mbedtls_mpi A, E, N, RR, Z; + mbedtls_mpi_init( &A ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &N ); + mbedtls_mpi_init( &RR ); mbedtls_mpi_init( &Z ); + + TEST_ASSERT( mbedtls_mpi_lset( &A, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_lset( &E, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_lset( &N, 1 ) == 0 ); + + TEST_ASSERT( mbedtls_mpi_shift_l( &A, ( A_bytes * 8 ) - 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_shift_l( &E, ( E_bytes * 8 ) - 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_shift_l( &N, ( N_bytes * 8 ) - 1 ) == 0 ); + + TEST_ASSERT( mbedtls_mpi_set_bit( &A, 0, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_set_bit( &E, 0, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_set_bit( &N, 0, 1 ) == 0 ); + + if( strlen( input_RR ) ) + TEST_ASSERT( mbedtls_mpi_read_string( &RR, radix_RR, input_RR ) == 0 ); + + TEST_ASSERT( mbedtls_mpi_exp_mod( &Z, &A, &E, &N, &RR ) == div_result ); + +exit: + mbedtls_mpi_free( &A ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &N ); + mbedtls_mpi_free( &RR ); mbedtls_mpi_free( &Z ); +} +/* END_CASE */ + /* BEGIN_CASE */ void mbedtls_mpi_inv_mod( int radix_X, char *input_X, int radix_Y, char *input_Y, int radix_A, char *input_A, int div_result ) From 2facdeeadfbc1773ebb140b77fa6c02c1c5d6066 Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Wed, 2 Dec 2020 16:27:42 +0000 Subject: [PATCH 11/18] Extend exponentiation test coverage Add two further boundary tests for cases where both the exponent and modulus to `mbedtls_mpi_exp_mod()` are `MBEDTLS_MPI_MAX_SIZE`, or longer, bytes long. Signed-off-by: Chris Jones --- tests/suites/test_suite_mpi.data | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index 5ac0d6d43..4261f053a 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -688,6 +688,12 @@ mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE:10:"":0 Base test mbedtls_mpi_exp_mod #10 (MAX_SIZE + 1 modulus) mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA +Base test mbedtls_mpi_exp_mod #11 (MAX_SIZE exponent and modulus) +mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE:MBEDTLS_MPI_MAX_SIZE:10:"":0 + +Base test mbedtls_mpi_exp_mod #12 (MAX_SIZE + 1 exponent and modulus) +mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA + Test mbedtls_mpi_exp_mod #1 mbedtls_mpi_exp_mod:10:"433019240910377478217373572959560109819648647016096560523769010881172869083338285573756574557395862965095016483867813043663981946477698466501451832407592327356331263124555137732393938242285782144928753919588632679050799198937132922145084847":10:"5781538327977828897150909166778407659250458379645823062042492461576758526757490910073628008613977550546382774775570888130029763571528699574717583228939535960234464230882573615930384979100379102915657483866755371559811718767760594919456971354184113721":10:"583137007797276923956891216216022144052044091311388601652961409557516421612874571554415606746479105795833145583959622117418531166391184939066520869800857530421873250114773204354963864729386957427276448683092491947566992077136553066273207777134303397724679138833126700957":10:"":10:"114597449276684355144920670007147953232659436380163461553186940113929777196018164149703566472936578890991049344459204199888254907113495794730452699842273939581048142004834330369483813876618772578869083248061616444392091693787039636316845512292127097865026290173004860736":0 From 2f7d147dc8dd4ea15c626b99d37cd0c2a3baa1dd Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 11:35:41 +0000 Subject: [PATCH 12/18] Reword test cases Reword test cases to be easier to read and understand. Adds comments to better explain what the test is doing. Signed-off-by: Chris Jones --- tests/suites/test_suite_mpi.data | 12 ++++++------ tests/suites/test_suite_mpi.function | 19 +++++++++++-------- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index 4261f053a..fcef9c648 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -676,22 +676,22 @@ mbedtls_mpi_exp_mod:10:"23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_IN Base test mbedtls_mpi_exp_mod #6 (Negative base + exponent) mbedtls_mpi_exp_mod:10:"-23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA -Base test mbedtls_mpi_exp_mod #7 (MAX_SIZE exponent) +Test mbedtls_mpi_exp_mod: MAX_SIZE exponent mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE:2:10:"":0 -Base test mbedtls_mpi_exp_mod #8 (MAX_SIZE + 1 exponent) +Test mbedtls_mpi_exp_mod: MAX_SIZE + 1 exponent mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:2:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA -Base test mbedtls_mpi_exp_mod #9 (MAX_SIZE modulus) +Test mbedtls_mpi_exp_mod: MAX_SIZE modulus mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE:10:"":0 -Base test mbedtls_mpi_exp_mod #10 (MAX_SIZE + 1 modulus) +Test mbedtls_mpi_exp_mod: MAX_SIZE + 1 modulus mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA -Base test mbedtls_mpi_exp_mod #11 (MAX_SIZE exponent and modulus) +Test mbedtls_mpi_exp_mod: MAX_SIZE exponent and modulus mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE:MBEDTLS_MPI_MAX_SIZE:10:"":0 -Base test mbedtls_mpi_exp_mod #12 (MAX_SIZE + 1 exponent and modulus) +Test mbedtls_mpi_exp_mod: MAX_SIZE + 1 exponent and modulus mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA Test mbedtls_mpi_exp_mod #1 diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function index d1a96b68a..0c5781c85 100644 --- a/tests/suites/test_suite_mpi.function +++ b/tests/suites/test_suite_mpi.function @@ -901,28 +901,31 @@ exit: /* BEGIN_CASE */ void mbedtls_mpi_exp_mod_size( int A_bytes, int E_bytes, int N_bytes, - int radix_RR, char * input_RR, int div_result ) + int radix_RR, char * input_RR, int exp_result ) { mbedtls_mpi A, E, N, RR, Z; mbedtls_mpi_init( &A ); mbedtls_mpi_init( &E ); mbedtls_mpi_init( &N ); mbedtls_mpi_init( &RR ); mbedtls_mpi_init( &Z ); + /* Set A to 2^(A_bytes - 1) + 1 */ TEST_ASSERT( mbedtls_mpi_lset( &A, 1 ) == 0 ); - TEST_ASSERT( mbedtls_mpi_lset( &E, 1 ) == 0 ); - TEST_ASSERT( mbedtls_mpi_lset( &N, 1 ) == 0 ); - TEST_ASSERT( mbedtls_mpi_shift_l( &A, ( A_bytes * 8 ) - 1 ) == 0 ); - TEST_ASSERT( mbedtls_mpi_shift_l( &E, ( E_bytes * 8 ) - 1 ) == 0 ); - TEST_ASSERT( mbedtls_mpi_shift_l( &N, ( N_bytes * 8 ) - 1 ) == 0 ); - TEST_ASSERT( mbedtls_mpi_set_bit( &A, 0, 1 ) == 0 ); + + /* Set E to 2^(E_bytes - 1) + 1 */ + TEST_ASSERT( mbedtls_mpi_lset( &E, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_shift_l( &E, ( E_bytes * 8 ) - 1 ) == 0 ); TEST_ASSERT( mbedtls_mpi_set_bit( &E, 0, 1 ) == 0 ); + + /* Set N to 2^(N_bytes - 1) + 1 */ + TEST_ASSERT( mbedtls_mpi_lset( &N, 1 ) == 0 ); + TEST_ASSERT( mbedtls_mpi_shift_l( &N, ( N_bytes * 8 ) - 1 ) == 0 ); TEST_ASSERT( mbedtls_mpi_set_bit( &N, 0, 1 ) == 0 ); if( strlen( input_RR ) ) TEST_ASSERT( mbedtls_mpi_read_string( &RR, radix_RR, input_RR ) == 0 ); - TEST_ASSERT( mbedtls_mpi_exp_mod( &Z, &A, &E, &N, &RR ) == div_result ); + TEST_ASSERT( mbedtls_mpi_exp_mod( &Z, &A, &E, &N, &RR ) == exp_result ); exit: mbedtls_mpi_free( &A ); mbedtls_mpi_free( &E ); mbedtls_mpi_free( &N ); From 263320505b68c986f262d45be09870e7acc464a9 Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 11:52:40 +0000 Subject: [PATCH 13/18] Fix cases where exponentiation was not fully tested In two test cases, the exponentiation computation was not being fully tested as when A_bytes (the base) == N_bytes (the modulus) -> A = N. When this is the case A is reduced to 0 and therefore the result of the computation will always be 0. This fixes that issue and therefore increases the test coverage to ensure different computations are actually being run. Signed-off-by: Chris Jones --- tests/suites/test_suite_mpi.data | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index fcef9c648..68b88372e 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -677,10 +677,10 @@ Base test mbedtls_mpi_exp_mod #6 (Negative base + exponent) mbedtls_mpi_exp_mod:10:"-23":10:"-13":10:"29":10:"":10:"0":MBEDTLS_ERR_MPI_BAD_INPUT_DATA Test mbedtls_mpi_exp_mod: MAX_SIZE exponent -mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE:2:10:"":0 +mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE:10:10:"":0 Test mbedtls_mpi_exp_mod: MAX_SIZE + 1 exponent -mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:2:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA +mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:10:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA Test mbedtls_mpi_exp_mod: MAX_SIZE modulus mbedtls_mpi_exp_mod_size:2:2:MBEDTLS_MPI_MAX_SIZE:10:"":0 From d6e113fcbe0bf3677a95f7742ea0e6d7b492f635 Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 14:24:33 +0000 Subject: [PATCH 14/18] Fix broken testing on numbers that may be greater than MPI_MAX_SIZE Previously `mbedtls_mpi_exp_mod` was tested with values that were over `MBEDTLS_MPI_MAX_SIZE` in size. This is useful to do as some paths are only taken when the exponent is large enough however, on builds where `MBEDTLS_MPI_MAX_SIZE` is under the size of these test values. This fix turns off these tests when `MBEDTLS_MPI_MAX_SIZE` is too small to safely test (notably this is the case in config-thread.h). Signed-off-by: Chris Jones --- tests/suites/test_suite_mpi.function | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function index 0c5781c85..b0ebee416 100644 --- a/tests/suites/test_suite_mpi.function +++ b/tests/suites/test_suite_mpi.function @@ -1,6 +1,10 @@ /* BEGIN_HEADER */ #include "mbedtls/bignum.h" +#if MBEDTLS_MPI_MAX_BITS > 256 +#define MPI_MAX_BITS_LARGER_THAN_256 +#endif + typedef struct mbedtls_test_mpi_random { uint8_t *data; @@ -868,7 +872,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE */ +/* BEGIN_CASE depends_on:MPI_MAX_BITS_LARGER_THAN_256 */ void mbedtls_mpi_exp_mod( int radix_A, char *input_A, int radix_E, char *input_E, int radix_N, char *input_N, int radix_RR, char *input_RR, int radix_X, char *input_X, int div_result ) From 942774eb528c7a285c03e68f65bfd6cc7f34ab5b Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 15:22:25 +0000 Subject: [PATCH 15/18] Move dependancy to specific test cases Move dependancy on `MBEDTLS_MPI_MAX_BITS` to apply to the specific test cases which will break when `MBEDTLS_MPI_MAX_BITS` is too small. This re-enables previous tests that were turned off accidentally. Signed-off-by: Chris Jones --- tests/suites/test_suite_mpi.data | 4 +++- tests/suites/test_suite_mpi.function | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index 68b88372e..11ec6c85b 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -695,12 +695,14 @@ Test mbedtls_mpi_exp_mod: MAX_SIZE + 1 exponent and modulus mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA Test mbedtls_mpi_exp_mod #1 +depends_on:MPI_MAX_BITS_LARGER_THAN_256 mbedtls_mpi_exp_mod:10:"433019240910377478217373572959560109819648647016096560523769010881172869083338285573756574557395862965095016483867813043663981946477698466501451832407592327356331263124555137732393938242285782144928753919588632679050799198937132922145084847":10:"5781538327977828897150909166778407659250458379645823062042492461576758526757490910073628008613977550546382774775570888130029763571528699574717583228939535960234464230882573615930384979100379102915657483866755371559811718767760594919456971354184113721":10:"583137007797276923956891216216022144052044091311388601652961409557516421612874571554415606746479105795833145583959622117418531166391184939066520869800857530421873250114773204354963864729386957427276448683092491947566992077136553066273207777134303397724679138833126700957":10:"":10:"114597449276684355144920670007147953232659436380163461553186940113929777196018164149703566472936578890991049344459204199888254907113495794730452699842273939581048142004834330369483813876618772578869083248061616444392091693787039636316845512292127097865026290173004860736":0 Test mbedtls_mpi_exp_mod (Negative base) mbedtls_mpi_exp_mod:10:"-10000000000":10:"10000000000":10:"99999":10:"":10:"1":0 -Test mbedtls_mpi_exp_mod (Negative base) +Test mbedtls_mpi_exp_mod (Negative base) [#2] +depends_on:MPI_MAX_BITS_LARGER_THAN_256 mbedtls_mpi_exp_mod:16:"-9f13012cd92aa72fb86ac8879d2fde4f7fd661aaae43a00971f081cc60ca277059d5c37e89652e2af2585d281d66ef6a9d38a117e9608e9e7574cd142dc55278838a2161dd56db9470d4c1da2d5df15a908ee2eb886aaa890f23be16de59386663a12f1afbb325431a3e835e3fd89b98b96a6f77382f458ef9a37e1f84a03045c8676ab55291a94c2228ea15448ee96b626b998":16:"40a54d1b9e86789f06d9607fb158672d64867665c73ee9abb545fc7a785634b354c7bae5b962ce8040cf45f2c1f3d3659b2ee5ede17534c8fc2ec85c815e8df1fe7048d12c90ee31b88a68a081f17f0d8ce5f4030521e9400083bcea73a429031d4ca7949c2000d597088e0c39a6014d8bf962b73bb2e8083bd0390a4e00b9b3":16:"eeaf0ab9adb38dd69c33f80afa8fc5e86072618775ff3c0b9ea2314c9c256576d674df7496ea81d3383b4813d692c6e0e0d5d8e250b98be48e495c1d6089dad15dc7d7b46154d6b6ce8ef4ad69b15d4982559b297bcf1885c529f566660e57ec68edbc3c05726cc02fd4cbf4976eaa9afd5138fe8376435b9fc61d2fc0eb06e3":16:"":16:"21acc7199e1b90f9b4844ffe12c19f00ec548c5d32b21c647d48b6015d8eb9ec9db05b4f3d44db4227a2b5659c1a7cceb9d5fa8fa60376047953ce7397d90aaeb7465e14e820734f84aa52ad0fc66701bcbb991d57715806a11531268e1e83dd48288c72b424a6287e9ce4e5cc4db0dd67614aecc23b0124a5776d36e5c89483":0 Base test GCD #1 diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function index b0ebee416..d7fe6b9bf 100644 --- a/tests/suites/test_suite_mpi.function +++ b/tests/suites/test_suite_mpi.function @@ -872,7 +872,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MPI_MAX_BITS_LARGER_THAN_256 */ +/* BEGIN_CASE */ void mbedtls_mpi_exp_mod( int radix_A, char *input_A, int radix_E, char *input_E, int radix_N, char *input_N, int radix_RR, char *input_RR, int radix_X, char *input_X, int div_result ) From 419c1046104e41cd93e323abb4725550034f0011 Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 15:45:29 +0000 Subject: [PATCH 16/18] Fix whitespace in changelog entry Extra whitespace and a missing newline at end of file was causing an error with `check_files.py`. Signed-off-by: Chris Jones --- ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt b/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt index 982b7bc2c..2ba98d541 100644 --- a/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt +++ b/ChangeLog.d/limit_size_of_diffie_hellman_calculations.txt @@ -1,4 +1,4 @@ Security - * Limit the size of calculations performed by mbedtls_mpi_exp_mod to - MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when - generating Diffie-Hellman key pairs. Credit to OSS-Fuzz. \ No newline at end of file + * Limit the size of calculations performed by mbedtls_mpi_exp_mod to + MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when + generating Diffie-Hellman key pairs. Credit to OSS-Fuzz. From ede3addc1714c45787475c6949d525db481bb522 Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 17:33:55 +0000 Subject: [PATCH 17/18] Fix test_suite_dhm build Fix build as the name of the random function changed from development to 2.7. Signed-off-by: Chris Jones --- tests/suites/test_suite_dhm.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_dhm.function b/tests/suites/test_suite_dhm.function index 2d1ef26f7..9f1f1ff2f 100644 --- a/tests/suites/test_suite_dhm.function +++ b/tests/suites/test_suite_dhm.function @@ -119,7 +119,7 @@ void dhm_make_public( int P_bytes, int radix_G, char *input_G, int result ) TEST_ASSERT( mbedtls_dhm_set_group( &ctx, &P, &G ) == 0 ); TEST_ASSERT( mbedtls_dhm_make_public( &ctx, (int) mbedtls_mpi_size( &P ), output, sizeof(output), - &mbedtls_test_rnd_pseudo_rand, + &rnd_pseudo_rand, NULL ) == result ); exit: From 43e7acd3b457706c7502e7a0353e1edd9f28567f Mon Sep 17 00:00:00 2001 From: Chris Jones Date: Thu, 3 Dec 2020 17:44:03 +0000 Subject: [PATCH 18/18] Fix exponentiation tests with `MBEDTLS_MPI_MAX_BITS` larger than 256 Fixes an issue where configs that had `MBEDTLS_MPI_MAX_BITS` greater than 256 but smaller than the test that was running (792 bits) the test would fail incorrectly. Signed-off-by: Chris Jones --- tests/suites/test_suite_mpi.data | 4 ++-- tests/suites/test_suite_mpi.function | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_mpi.data b/tests/suites/test_suite_mpi.data index 11ec6c85b..f625d7315 100644 --- a/tests/suites/test_suite_mpi.data +++ b/tests/suites/test_suite_mpi.data @@ -695,14 +695,14 @@ Test mbedtls_mpi_exp_mod: MAX_SIZE + 1 exponent and modulus mbedtls_mpi_exp_mod_size:2:MBEDTLS_MPI_MAX_SIZE + 1:MBEDTLS_MPI_MAX_SIZE + 1:10:"":MBEDTLS_ERR_MPI_BAD_INPUT_DATA Test mbedtls_mpi_exp_mod #1 -depends_on:MPI_MAX_BITS_LARGER_THAN_256 +depends_on:MPI_MAX_BITS_LARGER_THAN_792 mbedtls_mpi_exp_mod:10:"433019240910377478217373572959560109819648647016096560523769010881172869083338285573756574557395862965095016483867813043663981946477698466501451832407592327356331263124555137732393938242285782144928753919588632679050799198937132922145084847":10:"5781538327977828897150909166778407659250458379645823062042492461576758526757490910073628008613977550546382774775570888130029763571528699574717583228939535960234464230882573615930384979100379102915657483866755371559811718767760594919456971354184113721":10:"583137007797276923956891216216022144052044091311388601652961409557516421612874571554415606746479105795833145583959622117418531166391184939066520869800857530421873250114773204354963864729386957427276448683092491947566992077136553066273207777134303397724679138833126700957":10:"":10:"114597449276684355144920670007147953232659436380163461553186940113929777196018164149703566472936578890991049344459204199888254907113495794730452699842273939581048142004834330369483813876618772578869083248061616444392091693787039636316845512292127097865026290173004860736":0 Test mbedtls_mpi_exp_mod (Negative base) mbedtls_mpi_exp_mod:10:"-10000000000":10:"10000000000":10:"99999":10:"":10:"1":0 Test mbedtls_mpi_exp_mod (Negative base) [#2] -depends_on:MPI_MAX_BITS_LARGER_THAN_256 +depends_on:MPI_MAX_BITS_LARGER_THAN_792 mbedtls_mpi_exp_mod:16:"-9f13012cd92aa72fb86ac8879d2fde4f7fd661aaae43a00971f081cc60ca277059d5c37e89652e2af2585d281d66ef6a9d38a117e9608e9e7574cd142dc55278838a2161dd56db9470d4c1da2d5df15a908ee2eb886aaa890f23be16de59386663a12f1afbb325431a3e835e3fd89b98b96a6f77382f458ef9a37e1f84a03045c8676ab55291a94c2228ea15448ee96b626b998":16:"40a54d1b9e86789f06d9607fb158672d64867665c73ee9abb545fc7a785634b354c7bae5b962ce8040cf45f2c1f3d3659b2ee5ede17534c8fc2ec85c815e8df1fe7048d12c90ee31b88a68a081f17f0d8ce5f4030521e9400083bcea73a429031d4ca7949c2000d597088e0c39a6014d8bf962b73bb2e8083bd0390a4e00b9b3":16:"eeaf0ab9adb38dd69c33f80afa8fc5e86072618775ff3c0b9ea2314c9c256576d674df7496ea81d3383b4813d692c6e0e0d5d8e250b98be48e495c1d6089dad15dc7d7b46154d6b6ce8ef4ad69b15d4982559b297bcf1885c529f566660e57ec68edbc3c05726cc02fd4cbf4976eaa9afd5138fe8376435b9fc61d2fc0eb06e3":16:"":16:"21acc7199e1b90f9b4844ffe12c19f00ec548c5d32b21c647d48b6015d8eb9ec9db05b4f3d44db4227a2b5659c1a7cceb9d5fa8fa60376047953ce7397d90aaeb7465e14e820734f84aa52ad0fc66701bcbb991d57715806a11531268e1e83dd48288c72b424a6287e9ce4e5cc4db0dd67614aecc23b0124a5776d36e5c89483":0 Base test GCD #1 diff --git a/tests/suites/test_suite_mpi.function b/tests/suites/test_suite_mpi.function index d7fe6b9bf..5bf4c2775 100644 --- a/tests/suites/test_suite_mpi.function +++ b/tests/suites/test_suite_mpi.function @@ -1,8 +1,8 @@ /* BEGIN_HEADER */ #include "mbedtls/bignum.h" -#if MBEDTLS_MPI_MAX_BITS > 256 -#define MPI_MAX_BITS_LARGER_THAN_256 +#if MBEDTLS_MPI_MAX_BITS > 792 +#define MPI_MAX_BITS_LARGER_THAN_792 #endif typedef struct mbedtls_test_mpi_random