summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-oe/recipes-support/nss/nss/0001-Bug-1780432-CVE-2023-5388-Timing-attack-against-RSA-.patch681
-rw-r--r--meta-oe/recipes-support/nss/nss_3.74.bb1
2 files changed, 682 insertions, 0 deletions
diff --git a/meta-oe/recipes-support/nss/nss/0001-Bug-1780432-CVE-2023-5388-Timing-attack-against-RSA-.patch b/meta-oe/recipes-support/nss/nss/0001-Bug-1780432-CVE-2023-5388-Timing-attack-against-RSA-.patch
new file mode 100644
index 0000000000..d7c5aae50a
--- /dev/null
+++ b/meta-oe/recipes-support/nss/nss/0001-Bug-1780432-CVE-2023-5388-Timing-attack-against-RSA-.patch
@@ -0,0 +1,681 @@
1From 765b89613b16866c3f3241605d84917e5c5baf0d Mon Sep 17 00:00:00 2001
2From: Robert Relyea <rrelyea@redhat.com>
3Date: Wed, 14 Feb 2024 18:55:02 +0000
4Subject: [PATCH] Bug 1780432 (CVE-2023-5388) Timing attack against RSA
5 decryption (in TLS) r=jschanck
6
71. Add Constant time mult mod functions.
8 a. constant time mul
9 b. use constant time montgomery reduce.
10
112. Use montgomery values for blinding.
12
13Differential Revision: https://phabricator.services.mozilla.com/D197807
14
15--HG--
16extra : moz-landing-system : lando
17
18CVE: CVE-2023-5388
19Upstream-Status: Backport [https://github.com/nss-dev/nss/commit/765b89613b16866c3f3241605d84917e5c5baf0d]
20
21Signed-off-by: Peter Marko <peter.marko@siemens.com>
22---
23 lib/freebl/mpi/mpi-priv.h | 3 +
24 lib/freebl/mpi/mpi.c | 300 +++++++++++++++++++++++++++++++++++---
25 lib/freebl/mpi/mpi.h | 41 ++++++
26 lib/freebl/mpi/mpmontg.c | 29 ++--
27 lib/freebl/rsa.c | 16 +-
28 5 files changed, 358 insertions(+), 31 deletions(-)
29
30diff --git a/lib/freebl/mpi/mpi-priv.h b/lib/freebl/mpi/mpi-priv.h
31index 9447a818f..b4333fb6b 100644
32--- a/lib/freebl/mpi/mpi-priv.h
33+++ b/lib/freebl/mpi/mpi-priv.h
34@@ -204,6 +204,9 @@ void MPI_ASM_DECL s_mpv_mul_d_add(const mp_digit *a, mp_size a_len,
35 void MPI_ASM_DECL s_mpv_mul_d_add_prop(const mp_digit *a,
36 mp_size a_len, mp_digit b,
37 mp_digit *c);
38+void MPI_ASM_DECL s_mpv_mul_d_add_propCT(const mp_digit *a,
39+ mp_size a_len, mp_digit b,
40+ mp_digit *c, mp_size c_len);
41 void MPI_ASM_DECL s_mpv_sqr_add_prop(const mp_digit *a,
42 mp_size a_len,
43 mp_digit *sqrs);
44diff --git a/lib/freebl/mpi/mpi.c b/lib/freebl/mpi/mpi.c
45index 2e6cd8466..7749dc710 100644
46--- a/lib/freebl/mpi/mpi.c
47+++ b/lib/freebl/mpi/mpi.c
48@@ -13,6 +13,8 @@
49 #include <c_asm.h>
50 #endif
51
52+#include <assert.h>
53+
54 #if defined(__arm__) && \
55 ((defined(__thumb__) && !defined(__thumb2__)) || defined(__ARM_ARCH_3__))
56 /* 16-bit thumb or ARM v3 doesn't work inlined assember version */
57@@ -805,15 +807,18 @@ CLEANUP:
58
59 /* }}} */
60
61-/* {{{ mp_mul(a, b, c) */
62+/* {{{ s_mp_mulg(a, b, c) */
63
64 /*
65- mp_mul(a, b, c)
66+ s_mp_mulg(a, b, c)
67
68- Compute c = a * b. All parameters may be identical.
69+ Compute c = a * b. All parameters may be identical. if constantTime is set,
70+ then the operations are done in constant time. The original is mostly
71+ constant time as long as s_mpv_mul_d_add() is constant time. This is true
72+ of the x86 assembler, as well as the current c code.
73 */
74 mp_err
75-mp_mul(const mp_int *a, const mp_int *b, mp_int *c)
76+s_mp_mulg(const mp_int *a, const mp_int *b, mp_int *c, int constantTime)
77 {
78 mp_digit *pb;
79 mp_int tmp;
80@@ -849,7 +854,14 @@ mp_mul(const mp_int *a, const mp_int *b, mp_int *c)
81 goto CLEANUP;
82
83 #ifdef NSS_USE_COMBA
84- if ((MP_USED(a) == MP_USED(b)) && IS_POWER_OF_2(MP_USED(b))) {
85+ /* comba isn't constant time because it clamps! If we cared
86+ * (we needed a constant time version of multiply that was 'faster'
87+ * we could easily pass constantTime down to the comba code and
88+ * get it to skip the clamp... but here are assembler versions
89+ * which add comba to platforms that can't compile the normal
90+ * comba's imbedded assembler which would also need to change, so
91+ * for now we just skip comba when we are running constant time. */
92+ if (!constantTime && (MP_USED(a) == MP_USED(b)) && IS_POWER_OF_2(MP_USED(b))) {
93 if (MP_USED(a) == 4) {
94 s_mp_mul_comba_4(a, b, c);
95 goto CLEANUP;
96@@ -879,13 +891,15 @@ mp_mul(const mp_int *a, const mp_int *b, mp_int *c)
97 mp_digit b_i = *pb++;
98
99 /* Inner product: Digits of a */
100- if (b_i)
101+ if (constantTime || b_i)
102 s_mpv_mul_d_add(MP_DIGITS(a), useda, b_i, MP_DIGITS(c) + ib);
103 else
104 MP_DIGIT(c, ib + useda) = b_i;
105 }
106
107- s_mp_clamp(c);
108+ if (!constantTime) {
109+ s_mp_clamp(c);
110+ }
111
112 if (SIGN(a) == SIGN(b) || s_mp_cmp_d(c, 0) == MP_EQ)
113 SIGN(c) = ZPOS;
114@@ -895,10 +909,54 @@ mp_mul(const mp_int *a, const mp_int *b, mp_int *c)
115 CLEANUP:
116 mp_clear(&tmp);
117 return res;
118+} /* end smp_mulg() */
119+
120+/* }}} */
121+
122+/* {{{ mp_mul(a, b, c) */
123+
124+/*
125+ mp_mul(a, b, c)
126+
127+ Compute c = a * b. All parameters may be identical.
128+ */
129+
130+mp_err
131+mp_mul(const mp_int *a, const mp_int *b, mp_int *c)
132+{
133+ return s_mp_mulg(a, b, c, 0);
134 } /* end mp_mul() */
135
136 /* }}} */
137
138+/* {{{ mp_mulCT(a, b, c) */
139+
140+/*
141+ mp_mulCT(a, b, c)
142+
143+ Compute c = a * b. In constant time. Parameters may not be identical.
144+ NOTE: a and b may be modified.
145+ */
146+
147+mp_err
148+mp_mulCT(mp_int *a, mp_int *b, mp_int *c, mp_size setSize)
149+{
150+ mp_err res;
151+
152+ /* make the multiply values fixed length so multiply
153+ * doesn't leak the length. at this point all the
154+ * values are blinded, but once we finish we want the
155+ * output size to be hidden (so no clamping the out put) */
156+ MP_CHECKOK(s_mp_pad(a, setSize));
157+ MP_CHECKOK(s_mp_pad(b, setSize));
158+ MP_CHECKOK(s_mp_pad(c, 2 * setSize));
159+ MP_CHECKOK(s_mp_mulg(a, b, c, 1));
160+CLEANUP:
161+ return res;
162+} /* end mp_mulCT() */
163+
164+/* }}} */
165+
166 /* {{{ mp_sqr(a, sqr) */
167
168 #if MP_SQUARE
169@@ -1271,6 +1329,138 @@ mp_mod(const mp_int *a, const mp_int *m, mp_int *c)
170
171 /* }}} */
172
173+/* {{{ s_mp_subCT_d(a, b, borrow, c) */
174+
175+/*
176+ s_mp_subCT_d(a, b, borrow, c)
177+
178+ Compute c = (a -b) - subtract in constant time. returns borrow
179+ */
180+mp_digit
181+s_mp_subCT_d(mp_digit a, mp_digit b, mp_digit borrow, mp_digit *ret)
182+{
183+ *ret = a - b - borrow;
184+ return MP_CT_LTU(a, *ret) | (MP_CT_EQ(a, *ret) & borrow);
185+} /* s_mp_subCT_d() */
186+
187+/* }}} */
188+
189+/* {{{ mp_subCT(a, b, ret, borrow) */
190+
191+/* return ret= a - b and borrow in borrow. done in constant time.
192+ * b could be modified.
193+ */
194+mp_err
195+mp_subCT(const mp_int *a, mp_int *b, mp_int *ret, mp_digit *borrow)
196+{
197+ mp_size used_a = MP_USED(a);
198+ mp_size i;
199+ mp_err res;
200+
201+ MP_CHECKOK(s_mp_pad(b, used_a));
202+ MP_CHECKOK(s_mp_pad(ret, used_a));
203+ *borrow = 0;
204+ for (i = 0; i < used_a; i++) {
205+ *borrow = s_mp_subCT_d(MP_DIGIT(a, i), MP_DIGIT(b, i), *borrow,
206+ &MP_DIGIT(ret, i));
207+ }
208+
209+ res = MP_OKAY;
210+CLEANUP:
211+ return res;
212+} /* end mp_subCT() */
213+
214+/* }}} */
215+
216+/* {{{ mp_selectCT(cond, a, b, ret) */
217+
218+/*
219+ * return ret= cond ? a : b; cond should be either 0 or 1
220+ */
221+mp_err
222+mp_selectCT(mp_digit cond, const mp_int *a, const mp_int *b, mp_int *ret)
223+{
224+ mp_size used_a = MP_USED(a);
225+ mp_err res;
226+ mp_size i;
227+
228+ cond *= MP_DIGIT_MAX;
229+
230+ /* we currently require these to be equal on input,
231+ * we could use pad to extend one of them, but that might
232+ * leak data as it wouldn't be constant time */
233+ if (used_a != MP_USED(b)) {
234+ return MP_BADARG;
235+ }
236+
237+ MP_CHECKOK(s_mp_pad(ret, used_a));
238+ for (i = 0; i < used_a; i++) {
239+ MP_DIGIT(ret, i) = MP_CT_SEL_DIGIT(cond, MP_DIGIT(a, i), MP_DIGIT(b, i));
240+ }
241+ res = MP_OKAY;
242+CLEANUP:
243+ return res;
244+} /* end mp_selectCT() */
245+
246+/* {{{ mp_reduceCT(a, m, c) */
247+
248+/*
249+ mp_reduceCT(a, m, c)
250+
251+ Compute c = aR^-1 (mod m) in constant time.
252+ input should be in montgomery form. If input is the
253+ result of a montgomery multiply then out put will be
254+ in mongomery form.
255+ Result will be reduced to MP_USED(m), but not be
256+ clamped.
257+ */
258+
259+mp_err
260+mp_reduceCT(const mp_int *a, const mp_int *m, mp_digit n0i, mp_int *c)
261+{
262+ mp_size used_m = MP_USED(m);
263+ mp_size used_c = used_m * 2 + 1;
264+ mp_digit *m_digits, *c_digits;
265+ mp_size i;
266+ mp_digit borrow, carry;
267+ mp_err res;
268+ mp_int sub;
269+
270+ MP_DIGITS(&sub) = 0;
271+ MP_CHECKOK(mp_init_size(&sub, used_m));
272+
273+ if (a != c) {
274+ MP_CHECKOK(mp_copy(a, c));
275+ }
276+ MP_CHECKOK(s_mp_pad(c, used_c));
277+ m_digits = MP_DIGITS(m);
278+ c_digits = MP_DIGITS(c);
279+ for (i = 0; i < used_m; i++) {
280+ mp_digit m_i = MP_DIGIT(c, i) * n0i;
281+ s_mpv_mul_d_add_propCT(m_digits, used_m, m_i, c_digits++, used_c--);
282+ }
283+ s_mp_rshd(c, used_m);
284+ /* MP_USED(c) should be used_m+1 with the high word being any carry
285+ * from the previous multiply, save that carry and drop the high
286+ * word for the substraction below */
287+ carry = MP_DIGIT(c, used_m);
288+ MP_DIGIT(c, used_m) = 0;
289+ MP_USED(c) = used_m;
290+ /* mp_subCT wants c and m to be the same size, we've already
291+ * guarrenteed that in the previous statement, so mp_subCT won't actually
292+ * modify m, so it's safe to recast */
293+ MP_CHECKOK(mp_subCT(c, (mp_int *)m, &sub, &borrow));
294+
295+ /* we return c-m if c >= m no borrow or there was a borrow and a carry */
296+ MP_CHECKOK(mp_selectCT(borrow ^ carry, c, &sub, c));
297+ res = MP_OKAY;
298+CLEANUP:
299+ mp_clear(&sub);
300+ return res;
301+} /* end mp_reduceCT() */
302+
303+/* }}} */
304+
305 /* {{{ mp_mod_d(a, d, c) */
306
307 /*
308@@ -1387,6 +1577,37 @@ mp_mulmod(const mp_int *a, const mp_int *b, const mp_int *m, mp_int *c)
309
310 /* }}} */
311
312+/* {{{ mp_mulmontmodCT(a, b, m, c) */
313+
314+/*
315+ mp_mulmontmodCT(a, b, m, c)
316+
317+ Compute c = (a * b) mod m in constant time wrt a and b. either a or b
318+ should be in montgomery form and the output is native. If both a and b
319+ are in montgomery form, then the output will also be in montgomery form
320+ and can be recovered with an mp_reduceCT call.
321+ NOTE: a and b may be modified.
322+ */
323+
324+mp_err
325+mp_mulmontmodCT(mp_int *a, mp_int *b, const mp_int *m, mp_digit n0i,
326+ mp_int *c)
327+{
328+ mp_err res;
329+
330+ ARGCHK(a != NULL && b != NULL && m != NULL && c != NULL, MP_BADARG);
331+
332+ if ((res = mp_mulCT(a, b, c, MP_USED(m))) != MP_OKAY)
333+ return res;
334+
335+ if ((res = mp_reduceCT(c, m, n0i, c)) != MP_OKAY)
336+ return res;
337+
338+ return MP_OKAY;
339+}
340+
341+/* }}} */
342+
343 /* {{{ mp_sqrmod(a, m, c) */
344
345 #if MP_SQUARE
346@@ -3946,15 +4167,63 @@ s_mp_mul(mp_int *a, const mp_int *b)
347 a1b0 = (a >> MP_HALF_DIGIT_BIT) * (b & MP_HALF_DIGIT_MAX); \
348 a1b0 += a0b1; \
349 Phi += a1b0 >> MP_HALF_DIGIT_BIT; \
350- if (a1b0 < a0b1) \
351- Phi += MP_HALF_RADIX; \
352+ Phi += (MP_CT_LTU(a1b0, a0b1)) << MP_HALF_DIGIT_BIT; \
353 a1b0 <<= MP_HALF_DIGIT_BIT; \
354 Plo += a1b0; \
355- if (Plo < a1b0) \
356- ++Phi; \
357+ Phi += MP_CT_LTU(Plo, a1b0); \
358 }
359 #endif
360
361+/* Constant time version of s_mpv_mul_d_add_prop.
362+ * Presently, this is only used by the Constant time Montgomery arithmetic code. */
363+/* c += a * b */
364+void
365+s_mpv_mul_d_add_propCT(const mp_digit *a, mp_size a_len, mp_digit b,
366+ mp_digit *c, mp_size c_len)
367+{
368+#if !defined(MP_NO_MP_WORD) && !defined(MP_NO_MUL_WORD)
369+ mp_digit d = 0;
370+
371+ c_len -= a_len;
372+ /* Inner product: Digits of a */
373+ while (a_len--) {
374+ mp_word w = ((mp_word)b * *a++) + *c + d;
375+ *c++ = ACCUM(w);
376+ d = CARRYOUT(w);
377+ }
378+
379+ /* propagate the carry to the end, even if carry is zero */
380+ while (c_len--) {
381+ mp_word w = (mp_word)*c + d;
382+ *c++ = ACCUM(w);
383+ d = CARRYOUT(w);
384+ }
385+#else
386+ mp_digit carry = 0;
387+ c_len -= a_len;
388+ while (a_len--) {
389+ mp_digit a_i = *a++;
390+ mp_digit a0b0, a1b1;
391+ MP_MUL_DxD(a_i, b, a1b1, a0b0);
392+
393+ a0b0 += carry;
394+ a1b1 += MP_CT_LTU(a0b0, carry);
395+ a0b0 += a_i = *c;
396+ a1b1 += MP_CT_LTU(a0b0, a_i);
397+
398+ *c++ = a0b0;
399+ carry = a1b1;
400+ }
401+ /* propagate the carry to the end, even if carry is zero */
402+ while (c_len--) {
403+ mp_digit c_i = *c;
404+ carry += c_i;
405+ *c++ = carry;
406+ carry = MP_CT_LTU(carry, c_i);
407+ }
408+#endif
409+}
410+
411 #if !defined(MP_ASSEMBLY_MULTIPLY)
412 /* c = a * b */
413 void
414@@ -3979,8 +4248,7 @@ s_mpv_mul_d(const mp_digit *a, mp_size a_len, mp_digit b, mp_digit *c)
415 MP_MUL_DxD(a_i, b, a1b1, a0b0);
416
417 a0b0 += carry;
418- if (a0b0 < carry)
419- ++a1b1;
420+ a1b1 += MP_CT_LTU(a0b0, carry);
421 *c++ = a0b0;
422 carry = a1b1;
423 }
424@@ -4012,11 +4280,9 @@ s_mpv_mul_d_add(const mp_digit *a, mp_size a_len, mp_digit b,
425 MP_MUL_DxD(a_i, b, a1b1, a0b0);
426
427 a0b0 += carry;
428- if (a0b0 < carry)
429- ++a1b1;
430+ a1b1 += MP_CT_LTU(a0b0, carry);
431 a0b0 += a_i = *c;
432- if (a0b0 < a_i)
433- ++a1b1;
434+ a1b1 += MP_CT_LTU(a0b0, a_i);
435 *c++ = a0b0;
436 carry = a1b1;
437 }
438diff --git a/lib/freebl/mpi/mpi.h b/lib/freebl/mpi/mpi.h
439index 4ba9b6a4b..dd129db0d 100644
440--- a/lib/freebl/mpi/mpi.h
441+++ b/lib/freebl/mpi/mpi.h
442@@ -150,6 +150,38 @@ typedef int mp_sword;
443 /* This defines the maximum I/O base (minimum is 2) */
444 #define MP_MAX_RADIX 64
445
446+/* Constant Time Macros on mp_digits */
447+#define MP_CT_HIGH_TO_LOW(x) ((mp_digit)((mp_digit)(x) >> (MP_DIGIT_BIT - 1)))
448+#define MP_CT_TRUE ((mp_digit)1)
449+#define MP_CT_FALSE ((mp_digit)0)
450+
451+/* basic zero and non zero tests */
452+#define MP_CT_NOT_ZERO(x) (MP_CT_HIGH_TO_LOW(((x) | (((mp_digit)0) - (x)))))
453+#define MP_CT_ZERO(x) (MP_CT_TRUE ^ MP_CT_HIGH_TO_LOW(((x) | (((mp_digit)0) - (x)))))
454+
455+/* basic constant-time helper macro for equalities and inequalities.
456+ * The inequalities will produce incorrect results if
457+ * abs(a-b) >= MP_DIGIT_SIZE/2. This can be avoided if unsigned values stay
458+ * within the range 0-MP_DIGIT_MAX/2. */
459+#define MP_CT_EQ(a, b) MP_CT_ZERO(((a) ^ (b)))
460+#define MP_CT_NE(a, b) MP_CT_NOT_ZERO(((a) ^ (b)))
461+#define MP_CT_GT(a, b) MP_CT_HIGH_TO_LOW((b) - (a))
462+#define MP_CT_LT(a, b) MP_CT_HIGH_TO_LOW((a) - (b))
463+#define MP_CT_GE(a, b) (MP_CT_TRUE ^ MP_CT_LT(a, b))
464+#define MP_CT_LE(a, b) (MP_CT_TRUE ^ MP_CT_GT(a, b))
465+
466+/* use constant time result to select a boolean value
467+ * or an mp digit depending on the args */
468+#define MP_CT_SEL(m, l, r) ((r) ^ ((m) & ((r) ^ (l))))
469+#define MP_CT_SELB(m, l, r) MP_CT_SEL(m, l, r) /* mask, l and r are booleans */
470+#define MP_CT_SEL_DIGIT(m, l, r) MP_CT_SEL(m, l, r) /*mask, l, and r are mp_digit */
471+
472+/* full inequalities that work with full mp_digit values */
473+#define MP_CT_OVERFLOW(a, b, c, d) \
474+ MP_CT_SELB(MP_CT_HIGH_TO_LOW((a) ^ (b)), \
475+ (MP_CT_HIGH_TO_LOW(d)), c)
476+#define MP_CT_LTU(a, b) MP_CT_OVERFLOW(a, b, MP_CT_LT(a, b), b)
477+
478 typedef struct {
479 mp_sign sign; /* sign of this quantity */
480 mp_size alloc; /* how many digits allocated */
481@@ -190,7 +222,9 @@ mp_err mp_neg(const mp_int *a, mp_int *b);
482 /* Full arithmetic */
483 mp_err mp_add(const mp_int *a, const mp_int *b, mp_int *c);
484 mp_err mp_sub(const mp_int *a, const mp_int *b, mp_int *c);
485+mp_err mp_subCT(const mp_int *a, mp_int *b, mp_int *c, mp_digit *borrow);
486 mp_err mp_mul(const mp_int *a, const mp_int *b, mp_int *c);
487+mp_err mp_mulCT(mp_int *a, mp_int *b, mp_int *c, mp_size setSize);
488 #if MP_SQUARE
489 mp_err mp_sqr(const mp_int *a, mp_int *b);
490 #else
491@@ -217,6 +251,12 @@ mp_err mp_exptmod(const mp_int *a, const mp_int *b, const mp_int *m, mp_int *c);
492 mp_err mp_exptmod_d(const mp_int *a, mp_digit d, const mp_int *m, mp_int *c);
493 #endif /* MP_MODARITH */
494
495+/* montgomery math */
496+mp_err mp_to_mont(const mp_int *x, const mp_int *N, mp_int *xMont);
497+mp_digit mp_calculate_mont_n0i(const mp_int *N);
498+mp_err mp_reduceCT(const mp_int *a, const mp_int *m, mp_digit n0i, mp_int *ct);
499+mp_err mp_mulmontmodCT(mp_int *a, mp_int *b, const mp_int *m, mp_digit n0i, mp_int *c);
500+
501 /* Comparisons */
502 int mp_cmp_z(const mp_int *a);
503 int mp_cmp_d(const mp_int *a, mp_digit d);
504@@ -224,6 +264,7 @@ int mp_cmp(const mp_int *a, const mp_int *b);
505 int mp_cmp_mag(const mp_int *a, const mp_int *b);
506 int mp_isodd(const mp_int *a);
507 int mp_iseven(const mp_int *a);
508+mp_err mp_selectCT(mp_digit cond, const mp_int *a, const mp_int *b, mp_int *ret);
509
510 /* Number theoretic */
511 mp_err mp_gcd(mp_int *a, mp_int *b, mp_int *c);
512diff --git a/lib/freebl/mpi/mpmontg.c b/lib/freebl/mpi/mpmontg.c
513index 58f5cde2a..63842c631 100644
514--- a/lib/freebl/mpi/mpmontg.c
515+++ b/lib/freebl/mpi/mpmontg.c
516@@ -129,20 +129,27 @@ CLEANUP:
517 }
518 #endif
519
520-STATIC
521 mp_err
522-s_mp_to_mont(const mp_int *x, mp_mont_modulus *mmm, mp_int *xMont)
523+mp_to_mont(const mp_int *x, const mp_int *N, mp_int *xMont)
524 {
525 mp_err res;
526
527 /* xMont = x * R mod N where N is modulus */
528- MP_CHECKOK(mp_copy(x, xMont));
529- MP_CHECKOK(s_mp_lshd(xMont, MP_USED(&mmm->N))); /* xMont = x << b */
530- MP_CHECKOK(mp_div(xMont, &mmm->N, 0, xMont)); /* mod N */
531+ if (x != xMont) {
532+ MP_CHECKOK(mp_copy(x, xMont));
533+ }
534+ MP_CHECKOK(s_mp_lshd(xMont, MP_USED(N))); /* xMont = x << b */
535+ MP_CHECKOK(mp_div(xMont, N, 0, xMont)); /* mod N */
536 CLEANUP:
537 return res;
538 }
539
540+mp_digit
541+mp_calculate_mont_n0i(const mp_int *N)
542+{
543+ return 0 - s_mp_invmod_radix(MP_DIGIT(N, 0));
544+}
545+
546 #ifdef MP_USING_MONT_MULF
547
548 /* the floating point multiply is already cache safe,
549@@ -198,7 +205,7 @@ mp_exptmod_f(const mp_int *montBase,
550 MP_CHECKOK(mp_init_size(&accum1, 3 * nLen + 2));
551
552 mp_set(&accum1, 1);
553- MP_CHECKOK(s_mp_to_mont(&accum1, mmm, &accum1));
554+ MP_CHECKOK(mp_to_mont(&accum1, &(mmm->N), &accum1));
555 MP_CHECKOK(s_mp_pad(&accum1, nLen));
556
557 oddPowSize = 2 * nLen + 1;
558@@ -478,7 +485,7 @@ mp_exptmod_i(const mp_int *montBase,
559
560 /* set accumulator to montgomery residue of 1 */
561 mp_set(&accum1, 1);
562- MP_CHECKOK(s_mp_to_mont(&accum1, mmm, &accum1));
563+ MP_CHECKOK(mp_to_mont(&accum1, &(mmm->N), &accum1));
564 pa1 = &accum1;
565 pa2 = &accum2;
566
567@@ -865,7 +872,7 @@ mp_exptmod_safe_i(const mp_int *montBase,
568 MP_CHECKOK(mp_init_size(&accum[2], 3 * nLen + 2));
569 MP_CHECKOK(mp_init_size(&accum[3], 3 * nLen + 2));
570 mp_set(&accum[0], 1);
571- MP_CHECKOK(s_mp_to_mont(&accum[0], mmm, &accum[0]));
572+ MP_CHECKOK(mp_to_mont(&accum[0], &(mmm->N), &accum[0]));
573 MP_CHECKOK(mp_copy(montBase, &accum[1]));
574 SQR(montBase, &accum[2]);
575 MUL_NOWEAVE(montBase, &accum[2], &accum[3]);
576@@ -884,7 +891,7 @@ mp_exptmod_safe_i(const mp_int *montBase,
577 } else {
578 if (first_window == 0) {
579 mp_set(&accum1, 1);
580- MP_CHECKOK(s_mp_to_mont(&accum1, mmm, &accum1));
581+ MP_CHECKOK(mp_to_mont(&accum1, &(mmm->N), &accum1));
582 } else {
583 /* assert first_window == 1? */
584 MP_CHECKOK(mp_copy(montBase, &accum1));
585@@ -1055,9 +1062,9 @@ mp_exptmod(const mp_int *inBase, const mp_int *exponent,
586 /* compute n0', given n0, n0' = -(n0 ** -1) mod MP_RADIX
587 ** where n0 = least significant mp_digit of N, the modulus.
588 */
589- mmm.n0prime = 0 - s_mp_invmod_radix(MP_DIGIT(modulus, 0));
590+ mmm.n0prime = mp_calculate_mont_n0i(modulus);
591
592- MP_CHECKOK(s_mp_to_mont(base, &mmm, &montBase));
593+ MP_CHECKOK(mp_to_mont(base, modulus, &montBase));
594
595 bits_in_exponent = mpl_significant_bits(exponent);
596 #ifdef MP_USING_CACHE_SAFE_MOD_EXP
597diff --git a/lib/freebl/rsa.c b/lib/freebl/rsa.c
598index 200f1bd55..67d65ba2b 100644
599--- a/lib/freebl/rsa.c
600+++ b/lib/freebl/rsa.c
601@@ -64,6 +64,8 @@ struct RSABlindingParamsStr {
602 SECItem modulus; /* list element "key" */
603 blindingParams *free, *bp; /* Blinding parameters queue */
604 blindingParams array[RSA_BLINDING_PARAMS_MAX_CACHE_SIZE];
605+ /* precalculate montegomery reduction value */
606+ mp_digit n0i; /* n0i = -( n & MP_DIGIT) ** -1 mod mp_RADIX */
607 };
608 typedef struct RSABlindingParamsStr RSABlindingParams;
609
610@@ -1146,6 +1148,8 @@ generate_blinding_params(RSAPrivateKey *key, mp_int *f, mp_int *g, mp_int *n,
611 CHECK_MPI_OK(mp_exptmod(&k, &e, n, f));
612 /* g = k**-1 mod n */
613 CHECK_MPI_OK(mp_invmod(&k, n, g));
614+ /* g in montgomery form.. */
615+ CHECK_MPI_OK(mp_to_mont(g, n, g));
616 cleanup:
617 if (kb)
618 PORT_ZFree(kb, modLen);
619@@ -1182,13 +1186,16 @@ init_blinding_params(RSABlindingParams *rsabp, RSAPrivateKey *key,
620 rsabp->bp = NULL;
621 rsabp->free = bp;
622
623+ /* precalculate montgomery reduction parameter */
624+ rsabp->n0i = mp_calculate_mont_n0i(n);
625+
626 /* List elements are keyed using the modulus */
627 return SECITEM_CopyItem(NULL, &rsabp->modulus, &key->modulus);
628 }
629
630 static SECStatus
631 get_blinding_params(RSAPrivateKey *key, mp_int *n, unsigned int modLen,
632- mp_int *f, mp_int *g)
633+ mp_int *f, mp_int *g, mp_digit *n0i)
634 {
635 RSABlindingParams *rsabp = NULL;
636 blindingParams *bpUnlinked = NULL;
637@@ -1248,6 +1255,7 @@ get_blinding_params(RSAPrivateKey *key, mp_int *n, unsigned int modLen,
638 /* We've found (or created) the RSAblindingParams struct for this key.
639 * Now, search its list of ready blinding params for a usable one.
640 */
641+ *n0i = rsabp->n0i;
642 while (0 != (bp = rsabp->bp)) {
643 #ifndef UNSAFE_FUZZER_MODE
644 if (--(bp->counter) > 0)
645@@ -1355,6 +1363,7 @@ cleanup:
646 if (err) {
647 MP_TO_SEC_ERROR(err);
648 }
649+ *n0i = 0;
650 return SECFailure;
651 }
652
653@@ -1374,6 +1383,7 @@ rsa_PrivateKeyOp(RSAPrivateKey *key,
654 mp_err err;
655 mp_int n, c, m;
656 mp_int f, g;
657+ mp_digit n0i;
658 if (!key || !output || !input) {
659 PORT_SetError(SEC_ERROR_INVALID_ARGS);
660 return SECFailure;
661@@ -1401,7 +1411,7 @@ rsa_PrivateKeyOp(RSAPrivateKey *key,
662 ** blinding factor
663 */
664 if (nssRSAUseBlinding) {
665- CHECK_SEC_OK(get_blinding_params(key, &n, modLen, &f, &g));
666+ CHECK_SEC_OK(get_blinding_params(key, &n, modLen, &f, &g, &n0i));
667 /* c' = c*f mod n */
668 CHECK_MPI_OK(mp_mulmod(&c, &f, &n, &c));
669 }
670@@ -1422,7 +1432,7 @@ rsa_PrivateKeyOp(RSAPrivateKey *key,
671 */
672 if (nssRSAUseBlinding) {
673 /* m = m'*g mod n */
674- CHECK_MPI_OK(mp_mulmod(&m, &g, &n, &m));
675+ CHECK_MPI_OK(mp_mulmontmodCT(&m, &g, &n, n0i, &m));
676 }
677 err = mp_to_fixlen_octets(&m, output, modLen);
678 if (err >= 0)
679--
6802.30.2
681
diff --git a/meta-oe/recipes-support/nss/nss_3.74.bb b/meta-oe/recipes-support/nss/nss_3.74.bb
index 333bbdfef0..c394c82e69 100644
--- a/meta-oe/recipes-support/nss/nss_3.74.bb
+++ b/meta-oe/recipes-support/nss/nss_3.74.bb
@@ -32,6 +32,7 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
32 file://system-pkcs11.txt \ 32 file://system-pkcs11.txt \
33 file://nss-fix-nsinstall-build.patch \ 33 file://nss-fix-nsinstall-build.patch \
34 file://0001-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch \ 34 file://0001-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch \
35 file://0001-Bug-1780432-CVE-2023-5388-Timing-attack-against-RSA-.patch;patchdir=nss \
35 " 36 "
36SRC_URI[sha256sum] = "88928811f9f40f87d42e2eaccdf6e454562e51486067f2ddbe90aa47ea6cd056" 37SRC_URI[sha256sum] = "88928811f9f40f87d42e2eaccdf6e454562e51486067f2ddbe90aa47ea6cd056"
37 38
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-16 17:32:19 +0000