1 From 278d54d95de9fa80b4ac9f6dd0f900841114ca8c Mon Sep 17 00:00:00 2001
2 From: Sean Parkinson <sean@wolfssl.com>
3 Date: Mon, 27 Aug 2018 10:16:40 +1000
4 Subject: [PATCH] Make RsaUnPad constant time when Block Type 2 message
6 (cherry picked from commit ab03f9291b040269ae21d33b9f01529ed8311728)
8 Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
12 @@ -24766,26 +24766,22 @@ static int DoSessionTicket(WOLFSSL* ssl,
13 * indistinguishable from correctly formatted RSA blocks
16 - ret = args->lastErr;
17 args->lastErr = 0; /* reset */
19 /* build PreMasterSecret */
20 ssl->arrays->preMasterSecret[0] = ssl->chVersion.major;
21 ssl->arrays->preMasterSecret[1] = ssl->chVersion.minor;
22 - if (ret == 0 && args->sigSz == SECRET_LEN &&
23 - args->output != NULL) {
24 + if (args->output != NULL) {
25 XMEMCPY(&ssl->arrays->preMasterSecret[VERSION_SZ],
26 - &args->output[VERSION_SZ],
27 - SECRET_LEN - VERSION_SZ);
28 + &args->output[VERSION_SZ],
29 + SECRET_LEN - VERSION_SZ);
32 - /* preMasterSecret has RNG and version set */
33 - /* return proper length and ignore error */
34 - /* error will be caught as decryption error */
35 - args->sigSz = SECRET_LEN;
39 + /* preMasterSecret has RNG and version set
40 + * return proper length and ignore error
41 + * error will be caught as decryption error
43 + args->sigSz = SECRET_LEN;
50 @@ -1136,12 +1136,12 @@ static int Hmac_UpdateFinal_CT(Hmac* hma
52 b = in[k - WOLFSSL_TLS_HMAC_INNER_SZ];
54 - b = ctMaskSel(atEoc, b, 0x80);
55 + b = ctMaskSel(atEoc, 0x80, b);
57 b &= ~isOutBlock | isEocBlock;
59 if (j >= blockSz - 8) {
60 - b = ctMaskSel(isOutBlock, b, lenBytes[j - (blockSz - 8)]);
61 + b = ctMaskSel(isOutBlock, lenBytes[j - (blockSz - 8)], b);
65 --- a/wolfcrypt/src/integer.c
66 +++ b/wolfcrypt/src/integer.c
67 @@ -321,6 +321,17 @@ int mp_to_unsigned_bin (mp_int * a, unsi
71 +int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c)
75 + len = mp_unsigned_bin_size(a);
77 + /* pad front w/ zeros to match length */
78 + for (i = 0; i < c - len; i++)
80 + return mp_to_unsigned_bin(a, b + i);
83 /* creates "a" then copies b into it */
84 int mp_init_copy (mp_int * a, mp_int * b)
85 --- a/wolfcrypt/src/misc.c
86 +++ b/wolfcrypt/src/misc.c
87 @@ -341,10 +341,22 @@ STATIC INLINE byte ctMaskEq(int a, int b
91 -/* Constant time - select b when mask is set and a otherwise. */
92 +/* Constant time - mask set when a != b. */
93 +STATIC INLINE byte ctMaskNotEq(int a, int b)
95 + return 0 - (a != b);
98 +/* Constant time - select a when mask is set and b otherwise. */
99 STATIC INLINE byte ctMaskSel(byte m, byte a, byte b)
101 - return (a & ~m) | (b & m);
102 + return (b & ~m) | (a & m);
105 +/* Constant time - select integer a when mask is set and integer b otherwise. */
106 +STATIC INLINE int ctMaskSelInt(byte m, int a, int b)
108 + return (b & (~(int)(char)m)) | (a & ((int)(char)m));
111 /* Constant time - bit set when a <= b. */
112 --- a/wolfcrypt/src/rsa.c
113 +++ b/wolfcrypt/src/rsa.c
114 @@ -989,10 +989,8 @@ static int RsaUnPad_OAEP(byte *pkcsBlock
115 ret += pkcsBlock[idx++] ^ 0x01; /* separator value is 0x01 */
116 ret += pkcsBlock[0] ^ 0x00; /* Y, the first value, should be 0 */
119 - WOLFSSL_MSG("RsaUnPad_OAEP: Padding Error");
120 - return BAD_PADDING_E;
122 + /* Return 0 data length on error. */
123 + idx = ctMaskSelInt(ctMaskEq(ret, 0), idx, pkcsBlockLen);
125 /* adjust pointer to correct location in array and return size of M */
126 *output = (byte*)(pkcsBlock + idx);
127 @@ -1078,48 +1076,60 @@ static int RsaUnPad_PSS(byte *pkcsBlock,
128 /* UnPad plaintext, set start to *output, return length of plaintext,
130 static int RsaUnPad(const byte *pkcsBlock, unsigned int pkcsBlockLen,
131 - byte **output, byte padValue)
132 + byte **output, byte padValue)
134 - word32 maxOutputLen = (pkcsBlockLen > 10) ? (pkcsBlockLen - 10) : 0;
135 - word32 invalid = 0;
142 if (output == NULL || pkcsBlockLen == 0) {
146 - if (pkcsBlock[0] != 0x0) { /* skip past zero */
149 - pkcsBlock++; pkcsBlockLen--;
150 + if (padValue == RSA_BLOCK_TYPE_1) {
151 + /* First byte must be 0x00 and Second byte, block type, 0x01 */
152 + if (pkcsBlock[0] != 0 || pkcsBlock[1] != RSA_BLOCK_TYPE_1) {
153 + WOLFSSL_MSG("RsaUnPad error, invalid formatting");
157 - /* Require block type padValue */
158 - invalid = (pkcsBlock[0] != padValue) || invalid;
159 + /* check the padding until we find the separator */
160 + for (i = 2; i < pkcsBlockLen && pkcsBlock[i++] == 0xFF; ) { }
162 - /* verify the padding until we find the separator */
163 - if (padValue == RSA_BLOCK_TYPE_1) {
164 - while (i<pkcsBlockLen && pkcsBlock[i++] == 0xFF) {/* Null body */}
167 - while (i<pkcsBlockLen && pkcsBlock[i++]) {/* Null body */}
169 + /* Minimum of 11 bytes of pre-message data and must have separator. */
170 + if (i < RSA_MIN_PAD_SZ || pkcsBlock[i-1] != 0) {
171 + WOLFSSL_MSG("RsaUnPad error, bad formatting");
175 - if (!(i==pkcsBlockLen || pkcsBlock[i-1]==0)) {
176 - WOLFSSL_MSG("RsaUnPad error, bad formatting");
178 + *output = (byte *)(pkcsBlock + i);
179 + ret = pkcsBlockLen - i;
185 - outputLen = pkcsBlockLen - i;
186 - invalid = (outputLen > maxOutputLen) || invalid;
187 + /* Decrypted with private key - unpad must be constant time. */
188 + for (i = 0, j = 2; j < pkcsBlockLen; j++) {
189 + /* Update i if not passed the separator and at separator. */
190 + i |= (~pastSep) & ctMaskEq(pkcsBlock[j], 0x00) & (j + 1);
191 + pastSep |= ctMaskEq(pkcsBlock[j], 0x00);
194 + /* Minimum of 11 bytes of pre-message data - including leading 0x00. */
195 + invalid |= ctMaskLT(i, RSA_MIN_PAD_SZ);
196 + /* Must have seen separator. */
197 + invalid |= ~pastSep;
198 + /* First byte must be 0x00. */
199 + invalid |= ctMaskNotEq(pkcsBlock[0], 0x00);
200 + /* Check against expected block type: padValue */
201 + invalid |= ctMaskNotEq(pkcsBlock[1], padValue);
204 - WOLFSSL_MSG("RsaUnPad error, invalid formatting");
206 + *output = (byte *)(pkcsBlock + i);
207 + ret = ((int)~invalid) & (pkcsBlockLen - i);
210 - *output = (byte *)(pkcsBlock + i);
215 /* helper function to direct unpadding
216 @@ -1249,7 +1259,7 @@ static int wc_RsaFunctionSync(const byte
220 - word32 keyLen, len;
224 #ifdef WOLFSSL_HAVE_SP_RSA
225 @@ -1308,6 +1318,7 @@ static int wc_RsaFunctionSync(const byte
229 +#ifndef TEST_UNPAD_CONSTANT_TIME
230 if (mp_read_unsigned_bin(&tmp, (byte*)in, inLen) != MP_OKAY)
231 ERROR_OUT(MP_READ_E);
233 @@ -1418,21 +1429,18 @@ static int wc_RsaFunctionSync(const byte
234 ERROR_OUT(RSA_BUFFER_E);
237 - len = mp_unsigned_bin_size(&tmp);
239 - /* pad front w/ zeros to match key length */
240 - while (len < keyLen) {
248 - if (mp_to_unsigned_bin(&tmp, out) != MP_OKAY)
249 + if (mp_to_unsigned_bin_len(&tmp, out, keyLen) != MP_OKAY)
257 + XMEMCPY(out, in, inLen);
261 #ifdef WC_RSA_BLINDING
262 if (type == RSA_PRIVATE_DECRYPT || type == RSA_PRIVATE_ENCRYPT) {
263 @@ -1633,6 +1641,7 @@ int wc_RsaFunction(const byte* in, word3
267 +#ifndef TEST_UNPAD_CONSTANT_TIME
268 #ifndef NO_RSA_BOUNDS_CHECK
269 if (type == RSA_PRIVATE_DECRYPT &&
270 key->state == RSA_STATE_DECRYPT_EXPTMOD) {
271 @@ -1667,6 +1676,7 @@ int wc_RsaFunction(const byte* in, word3
274 #endif /* NO_RSA_BOUNDS_CHECK */
277 #if defined(WOLFSSL_ASYNC_CRYPT) && defined(WC_ASYNC_ENABLE_RSA)
278 if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA &&
279 @@ -1880,7 +1890,8 @@ static int RsaPrivateDecryptEx(byte* in,
281 /* if not doing this inline then allocate a buffer for it */
282 if (outPtr == NULL) {
283 - key->data = (byte*)XMALLOC(inLen, key->heap, DYNAMIC_TYPE_WOLF_BIGINT);
284 + key->data = (byte*)XMALLOC(inLen, key->heap,
285 + DYNAMIC_TYPE_WOLF_BIGINT);
286 key->dataIsAlloc = 1;
287 if (key->data == NULL) {
289 @@ -1909,20 +1920,29 @@ static int RsaPrivateDecryptEx(byte* in,
290 ret = wc_RsaUnPad_ex(key->data, key->dataLen, &pad, pad_value, pad_type,
291 hash, mgf, label, labelSz, saltLen,
292 mp_count_bits(&key->n), key->heap);
293 - if (ret > 0 && ret <= (int)outLen && pad != NULL) {
294 + if (rsa_type == RSA_PUBLIC_DECRYPT && ret > (int)outLen)
295 + ret = RSA_BUFFER_E;
296 + else if (ret >= 0 && pad != NULL) {
299 /* only copy output if not inline */
300 if (outPtr == NULL) {
301 - XMEMCPY(out, pad, ret);
303 + int start = (int)((size_t)pad - (size_t)key->data);
305 + for (i = 0, j = 0; j < key->dataLen; j++) {
306 + out[i] = key->data[j];
307 + c = ctMaskGTE(j, start);
308 + c &= ctMaskLT(i, outLen);
309 + /* 0 - no add, -1 add */
318 - else if (ret >= 0) {
319 - ret = RSA_BUFFER_E;
324 + ret = ctMaskSelInt(ctMaskLTE(ret, outLen), ret, RSA_BUFFER_E);
325 + ret = ctMaskSelInt(ctMaskNotEq(ret, 0), ret, RSA_BUFFER_E);
328 key->state = RSA_STATE_DECRYPT_RES;
329 @@ -1934,12 +1954,14 @@ static int RsaPrivateDecryptEx(byte* in,
331 if (key->asyncDev.marker == WOLFSSL_ASYNC_MARKER_RSA &&
332 pad_type != WC_RSA_PSS_PAD) {
333 - /* convert result */
334 - byte* dataLen = (byte*)&key->dataLen;
335 - ret = (dataLen[0] << 8) | (dataLen[1]);
337 + /* convert result */
338 + byte* dataLen = (byte*)&key->dataLen;
339 + ret = (dataLen[0] << 8) | (dataLen[1]);
349 --- a/wolfcrypt/src/sp_int.c
350 +++ b/wolfcrypt/src/sp_int.c
351 @@ -286,7 +286,8 @@ int sp_leading_bit(sp_int* a)
352 * The array must be large enough for encoded number - use mp_unsigned_bin_size
353 * to calculate the number of bytes required.
357 + * out Array to put encoding into.
358 * returns MP_OKAY always.
360 int sp_to_unsigned_bin(sp_int* a, byte* out)
361 @@ -305,6 +306,31 @@ int sp_to_unsigned_bin(sp_int* a, byte*
365 +/* Convert the big number to an array of bytes in big-endian format.
366 + * The array must be large enough for encoded number - use mp_unsigned_bin_size
367 + * to calculate the number of bytes required.
368 + * Front-pads the output array with zeros make number the size of the array.
371 + * out Array to put encoding into.
372 + * outSz Size of the array.
373 + * returns MP_OKAY always.
375 +int sp_to_unsigned_bin_len(sp_int* a, byte* out, int outSz)
380 + for (i=0; j>=0; i++) {
381 + for (b = 0; b < SP_WORD_SIZE; b += 8) {
382 + out[j--] = a->dp[i] >> b;
390 /* Ensure the data in the big number is zeroed.
393 --- a/wolfcrypt/src/tfm.c
394 +++ b/wolfcrypt/src/tfm.c
395 @@ -1964,6 +1964,48 @@ void fp_to_unsigned_bin(fp_int *a, unsig
399 +int fp_to_unsigned_bin_len(fp_int *a, unsigned char *b, int c)
401 +#if DIGIT_BIT == 64 || DIGIT_BIT == 32
404 + for (x=c-1,j=0,i=0; x >= 0; x--) {
405 + b[x] = (unsigned char)(a->dp[i] >> j);
407 + i += j == DIGIT_BIT;
408 + j &= DIGIT_BIT - 1;
414 +#ifndef WOLFSSL_SMALL_STACK
420 +#ifdef WOLFSSL_SMALL_STACK
421 + t = (fp_int*)XMALLOC(sizeof(fp_int), NULL, DYNAMIC_TYPE_TMP_BUFFER);
426 + fp_init_copy(t, a);
428 + for (x = 0; x < c; x++) {
429 + b[x] = (unsigned char) (t->dp[0] & 255);
430 + fp_div_2d (t, 8, t, NULL);
434 +#ifdef WOLFSSL_SMALL_STACK
435 + XFREE(t, NULL, DYNAMIC_TYPE_TMP_BUFFER);
441 int fp_unsigned_bin_size(fp_int *a)
443 int size = fp_count_bits (a);
444 @@ -2435,6 +2477,10 @@ int mp_to_unsigned_bin (mp_int * a, unsi
448 +int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c)
450 + return fp_to_unsigned_bin_len(a, b, c);
452 /* reads a unsigned char array, assumes the msb is stored first [big endian] */
453 int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c)
455 --- a/wolfssl/wolfcrypt/integer.h
456 +++ b/wolfssl/wolfcrypt/integer.h
457 @@ -277,6 +277,7 @@ MP_API int mp_unsigned_bin_size(mp_int
458 MP_API int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
459 MP_API int mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b);
460 MP_API int mp_to_unsigned_bin (mp_int * a, unsigned char *b);
461 +MP_API int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c);
462 MP_API int mp_exptmod (mp_int * G, mp_int * X, mp_int * P, mp_int * Y);
463 /* end functions needed by Rsa */
465 --- a/wolfssl/wolfcrypt/misc.h
466 +++ b/wolfssl/wolfcrypt/misc.h
467 @@ -97,7 +97,9 @@ WOLFSSL_LOCAL byte ctMaskGTE(int a, int
468 WOLFSSL_LOCAL byte ctMaskLT(int a, int b);
469 WOLFSSL_LOCAL byte ctMaskLTE(int a, int b);
470 WOLFSSL_LOCAL byte ctMaskEq(int a, int b);
471 +WOLFSSL_LOCAL byte ctMaskNotEq(int a, int b);
472 WOLFSSL_LOCAL byte ctMaskSel(byte m, byte a, byte b);
473 +WOLFSSL_LOCAL int ctMaskSelInt(byte m, int a, int b);
474 WOLFSSL_LOCAL byte ctSetLTE(int a, int b);
476 #endif /* NO_INLINE */
477 --- a/wolfssl/wolfcrypt/sp_int.h
478 +++ b/wolfssl/wolfcrypt/sp_int.h
479 @@ -119,7 +119,8 @@ MP_API int sp_read_radix(sp_int* a, cons
480 MP_API int sp_cmp(sp_int* a, sp_int* b);
481 MP_API int sp_count_bits(sp_int* a);
482 MP_API int sp_leading_bit(sp_int* a);
483 -MP_API int sp_to_unsigned_bin(sp_int* a, byte* in);
484 +MP_API int sp_to_unsigned_bin(sp_int* a, byte* out);
485 +MP_API int sp_to_unsigned_bin_len(sp_int* a, byte* out, int outSz);
486 MP_API void sp_forcezero(sp_int* a);
487 MP_API int sp_copy(sp_int* a, sp_int* b);
488 MP_API int sp_set(sp_int* a, sp_int_digit d);
489 @@ -156,30 +157,31 @@ typedef sp_digit mp_digit;
493 -#define mp_init sp_init
494 -#define mp_init_multi sp_init_multi
495 -#define mp_clear sp_clear
496 -#define mp_read_unsigned_bin sp_read_unsigned_bin
497 -#define mp_unsigned_bin_size sp_unsigned_bin_size
498 -#define mp_read_radix sp_read_radix
499 -#define mp_cmp sp_cmp
500 -#define mp_count_bits sp_count_bits
501 -#define mp_leading_bit sp_leading_bit
502 -#define mp_to_unsigned_bin sp_to_unsigned_bin
503 -#define mp_forcezero sp_forcezero
504 -#define mp_copy sp_copy
505 -#define mp_set sp_set
506 -#define mp_iszero sp_iszero
507 -#define mp_clamp sp_clamp
508 -#define mp_grow sp_grow
509 -#define mp_sub_d sp_sub_d
510 -#define mp_cmp_d sp_cmp_d
511 -#define mp_mod sp_mod
512 -#define mp_zero sp_zero
513 -#define mp_add_d sp_add_d
514 -#define mp_lshd sp_lshd
515 -#define mp_add sp_add
516 -#define mp_isodd sp_isodd
517 +#define mp_init sp_init
518 +#define mp_init_multi sp_init_multi
519 +#define mp_clear sp_clear
520 +#define mp_read_unsigned_bin sp_read_unsigned_bin
521 +#define mp_unsigned_bin_size sp_unsigned_bin_size
522 +#define mp_read_radix sp_read_radix
523 +#define mp_cmp sp_cmp
524 +#define mp_count_bits sp_count_bits
525 +#define mp_leading_bit sp_leading_bit
526 +#define mp_to_unsigned_bin sp_to_unsigned_bin
527 +#define mp_to_unsigned_bin_len sp_to_unsigned_bin_len
528 +#define mp_forcezero sp_forcezero
529 +#define mp_copy sp_copy
530 +#define mp_set sp_set
531 +#define mp_iszero sp_iszero
532 +#define mp_clamp sp_clamp
533 +#define mp_grow sp_grow
534 +#define mp_sub_d sp_sub_d
535 +#define mp_cmp_d sp_cmp_d
536 +#define mp_mod sp_mod
537 +#define mp_zero sp_zero
538 +#define mp_add_d sp_add_d
539 +#define mp_lshd sp_lshd
540 +#define mp_add sp_add
541 +#define mp_isodd sp_isodd
543 #define MP_INT_DEFINED
545 --- a/wolfssl/wolfcrypt/tfm.h
546 +++ b/wolfssl/wolfcrypt/tfm.h
547 @@ -563,6 +563,7 @@ int fp_leading_bit(fp_int *a);
548 int fp_unsigned_bin_size(fp_int *a);
549 void fp_read_unsigned_bin(fp_int *a, const unsigned char *b, int c);
550 void fp_to_unsigned_bin(fp_int *a, unsigned char *b);
551 +int fp_to_unsigned_bin_len(fp_int *a, unsigned char *b, int c);
552 int fp_to_unsigned_bin_at_pos(int x, fp_int *t, unsigned char *b);
554 /*int fp_signed_bin_size(fp_int *a);*/
555 @@ -686,6 +687,7 @@ MP_API int mp_unsigned_bin_size(mp_int
556 MP_API int mp_read_unsigned_bin (mp_int * a, const unsigned char *b, int c);
557 MP_API int mp_to_unsigned_bin_at_pos(int x, mp_int *t, unsigned char *b);
558 MP_API int mp_to_unsigned_bin (mp_int * a, unsigned char *b);
559 +MP_API int mp_to_unsigned_bin_len(mp_int * a, unsigned char *b, int c);
561 MP_API int mp_sub_d(fp_int *a, fp_digit b, fp_int *c);
562 MP_API int mp_copy(fp_int* a, fp_int* b);