yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-25 01:35:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3729 from pkolbus/issue-3647-2.7

Browse source 
Backport 2.7: Restore retry in rsa_prepare_blinding()
This commit is contained in:
Janos Follath 2020-09-30 16:22:56 +01:00 committed by GitHub
parent 2983b27a08 e634564381
commit b016d8d524
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ChangeLog.d/fix-rsa-blinding.txt Normal file
View file

@ -0,0 +1,6 @@
Bugfix
* Fix rsa_prepare_blinding() to retry when the blinding value is not
invertible (mod N), instead of returning MBEDTLS_ERR_RSA_RNG_FAILED. This
addresses a regression but is rare in practice (approx. 1 in 2/sqrt(N)).
Found by Synopsys Coverity, fix contributed by Peter Kolbus (Garmin).
Fixes #3647.

13
library/rsa.c
View file

@ -779,15 +779,14 @@ static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
* which one, we just loop and choose new values for both of them. * which one, we just loop and choose new values for both of them.
* (Each iteration succeeds with overwhelming probability.) */ * (Each iteration succeeds with overwhelming probability.) */
ret = mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vi, &ctx->N ); ret = mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vi, &ctx->N );
if( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE ) if( ret != 0 && ret != MBEDTLS_ERR_MPI_NOT_ACCEPTABLE )
continue;
if( ret != 0 )
goto cleanup; goto cleanup;
/* Finish the computation of Vf^-1 = R * (R Vf)^-1 */ } while( ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE );
MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &R ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) ); /* Finish the computation of Vf^-1 = R * (R Vf)^-1 */
} while( 0 ); MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &R ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
/* Blinding value: Vi = Vf^(-e) mod N /* Blinding value: Vi = Vf^(-e) mod N
* (Vi already contains Vf^-1 at this point) */ * (Vi already contains Vf^-1 at this point) */