summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch')
-rw-r--r--meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch147
1 files changed, 147 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch
new file mode 100644
index 0000000000..5209559659
--- /dev/null
+++ b/meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0006-SAE-Avoid-branches-in-is_quadratic_residue_blind.patch
@@ -0,0 +1,147 @@
1From 362704dda04507e7ebb8035122e83d9f0ae7c320 Mon Sep 17 00:00:00 2001
2From: Jouni Malinen <jouni@codeaurora.org>
3Date: Tue, 26 Feb 2019 19:34:38 +0200
4Subject: [PATCH 06/14] SAE: Avoid branches in is_quadratic_residue_blind()
5
6Make the non-failure path in the function proceed without branches based
7on r_odd and in constant time to minimize risk of observable differences
8in timing or cache use. (CVE-2019-9494)
9
10Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
11Signed-off-by: Adrian Bunk <bunk@stusta.de>
12Upstream-Status: Backport
13CVE: CVE-2019-9494
14---
15 src/common/sae.c | 64 ++++++++++++++++++++++++++++++++------------------------
16 1 file changed, 37 insertions(+), 27 deletions(-)
17
18diff --git a/src/common/sae.c b/src/common/sae.c
19index d55323b..5df9b95 100644
20--- a/src/common/sae.c
21+++ b/src/common/sae.c
22@@ -232,12 +232,14 @@ get_rand_1_to_p_1(const u8 *prime, size_t prime_len, size_t prime_bits,
23
24 static int is_quadratic_residue_blind(struct sae_data *sae,
25 const u8 *prime, size_t bits,
26- const struct crypto_bignum *qr,
27- const struct crypto_bignum *qnr,
28+ const u8 *qr, const u8 *qnr,
29 const struct crypto_bignum *y_sqr)
30 {
31- struct crypto_bignum *r, *num;
32+ struct crypto_bignum *r, *num, *qr_or_qnr = NULL;
33 int r_odd, check, res = -1;
34+ u8 qr_or_qnr_bin[SAE_MAX_ECC_PRIME_LEN];
35+ size_t prime_len = sae->tmp->prime_len;
36+ unsigned int mask;
37
38 /*
39 * Use the blinding technique to mask y_sqr while determining
40@@ -248,7 +250,7 @@ static int is_quadratic_residue_blind(struct sae_data *sae,
41 * r = a random number between 1 and p-1, inclusive
42 * num = (v * r * r) modulo p
43 */
44- r = get_rand_1_to_p_1(prime, sae->tmp->prime_len, bits, &r_odd);
45+ r = get_rand_1_to_p_1(prime, prime_len, bits, &r_odd);
46 if (!r)
47 return -1;
48
49@@ -258,41 +260,45 @@ static int is_quadratic_residue_blind(struct sae_data *sae,
50 crypto_bignum_mulmod(num, r, sae->tmp->prime, num) < 0)
51 goto fail;
52
53- if (r_odd) {
54- /*
55- * num = (num * qr) module p
56- * LGR(num, p) = 1 ==> quadratic residue
57- */
58- if (crypto_bignum_mulmod(num, qr, sae->tmp->prime, num) < 0)
59- goto fail;
60- check = 1;
61- } else {
62- /*
63- * num = (num * qnr) module p
64- * LGR(num, p) = -1 ==> quadratic residue
65- */
66- if (crypto_bignum_mulmod(num, qnr, sae->tmp->prime, num) < 0)
67- goto fail;
68- check = -1;
69- }
70+ /*
71+ * Need to minimize differences in handling different cases, so try to
72+ * avoid branches and timing differences.
73+ *
74+ * If r_odd:
75+ * num = (num * qr) module p
76+ * LGR(num, p) = 1 ==> quadratic residue
77+ * else:
78+ * num = (num * qnr) module p
79+ * LGR(num, p) = -1 ==> quadratic residue
80+ */
81+ mask = const_time_is_zero(r_odd);
82+ const_time_select_bin(mask, qnr, qr, prime_len, qr_or_qnr_bin);
83+ qr_or_qnr = crypto_bignum_init_set(qr_or_qnr_bin, prime_len);
84+ if (!qr_or_qnr ||
85+ crypto_bignum_mulmod(num, qr_or_qnr, sae->tmp->prime, num) < 0)
86+ goto fail;
87+ /* r_odd is 0 or 1; branchless version of check = r_odd ? 1 : -1, */
88+ check = const_time_select_int(mask, -1, 1);
89
90 res = crypto_bignum_legendre(num, sae->tmp->prime);
91 if (res == -2) {
92 res = -1;
93 goto fail;
94 }
95- res = res == check;
96+ /* branchless version of res = res == check
97+ * (res is -1, 0, or 1; check is -1 or 1) */
98+ mask = const_time_eq(res, check);
99+ res = const_time_select_int(mask, 1, 0);
100 fail:
101 crypto_bignum_deinit(num, 1);
102 crypto_bignum_deinit(r, 1);
103+ crypto_bignum_deinit(qr_or_qnr, 1);
104 return res;
105 }
106
107
108 static int sae_test_pwd_seed_ecc(struct sae_data *sae, const u8 *pwd_seed,
109- const u8 *prime,
110- const struct crypto_bignum *qr,
111- const struct crypto_bignum *qnr,
112+ const u8 *prime, const u8 *qr, const u8 *qnr,
113 u8 *pwd_value)
114 {
115 struct crypto_bignum *y_sqr, *x_cand;
116@@ -452,6 +458,8 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
117 struct crypto_bignum *x = NULL, *qr = NULL, *qnr = NULL;
118 u8 x_bin[SAE_MAX_ECC_PRIME_LEN];
119 u8 x_cand_bin[SAE_MAX_ECC_PRIME_LEN];
120+ u8 qr_bin[SAE_MAX_ECC_PRIME_LEN];
121+ u8 qnr_bin[SAE_MAX_ECC_PRIME_LEN];
122 size_t bits;
123 int res = -1;
124 u8 found = 0; /* 0 (false) or 0xff (true) to be used as const_time_*
125@@ -476,7 +484,9 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
126 * (qnr) modulo p for blinding purposes during the loop.
127 */
128 if (get_random_qr_qnr(prime, prime_len, sae->tmp->prime, bits,
129- &qr, &qnr) < 0)
130+ &qr, &qnr) < 0 ||
131+ crypto_bignum_to_bin(qr, qr_bin, sizeof(qr_bin), prime_len) < 0 ||
132+ crypto_bignum_to_bin(qnr, qnr_bin, sizeof(qnr_bin), prime_len) < 0)
133 goto fail;
134
135 wpa_hexdump_ascii_key(MSG_DEBUG, "SAE: password",
136@@ -527,7 +537,7 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
137 break;
138
139 res = sae_test_pwd_seed_ecc(sae, pwd_seed,
140- prime, qr, qnr, x_cand_bin);
141+ prime, qr_bin, qnr_bin, x_cand_bin);
142 const_time_select_bin(found, x_bin, x_cand_bin, prime_len,
143 x_bin);
144 pwd_seed_odd = const_time_select_u8(
145--
1462.7.4
147
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-15 18:50:40 +0000