Skip to content

Commit

Permalink
Address DSA/ECDSA side channel
Browse files Browse the repository at this point in the history
  • Loading branch information
@randombit
randombit committed Jun 13, 2018
1 parent 55774de commit 48fc8df
Show file tree
Hide file tree
Showing 5 changed files with 88 additions and 17 deletions.
8 changes: 8 additions & 0 deletions doc/security.rst
View file
Expand Up @@ -18,6 +18,14 @@ https://keybase.io/jacklloyd and on most PGP keyservers.
2018
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* 2018-06-13 (CVE-2018-0495): ECDSA side channel

A side channel in the ECDSA signature operation could allow a local attacker
to recover the secret key. Found by Keegan Ryan of NCC Group.

Fixed in 2.7.0. Due to a slight difference in code structure, versions before
2.5.0 are not affected by this issue.

* 2018-04-10 (CVE-2018-9860): Memory overread in TLS CBC decryption

An off by one error in TLS CBC decryption meant that for a particular
Expand Down
38 changes: 28 additions & 10 deletions src/lib/pubkey/dsa/dsa.cpp
View file
Expand Up @@ -74,7 +74,9 @@ namespace {
class DSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
{
public:
DSA_Signature_Operation(const DSA_PrivateKey& dsa, const std::string& emsa) :
DSA_Signature_Operation(const DSA_PrivateKey& dsa,
const std::string& emsa,
RandomNumberGenerator& rng) :
PK_Ops::Signature_with_EMSA(emsa),
m_group(dsa.get_group()),
m_x(dsa.get_x()),
Expand All @@ -83,6 +85,9 @@ class DSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
#if defined(BOTAN_HAS_RFC6979_GENERATOR)
m_rfc6979_hash = hash_for_emsa(emsa);
#endif

m_b = BigInt::random_integer(rng, 2, dsa.group_q());
m_b_inv = inverse_mod(m_b, dsa.group_q());
}

size_t max_input_bits() const override { return m_group.get_q().bits(); }
Expand All @@ -96,6 +101,8 @@ class DSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
#if defined(BOTAN_HAS_RFC6979_GENERATOR)
std::string m_rfc6979_hash;
#endif

BigInt m_b, m_b_inv;
};

secure_vector<uint8_t>
Expand All @@ -104,22 +111,32 @@ DSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
{
const BigInt& q = m_group.get_q();

BigInt i(msg, msg_len, q.bits());
BigInt m(msg, msg_len, q.bits());

while(i >= q)
i -= q;
while(m >= q)
m -= q;

#if defined(BOTAN_HAS_RFC6979_GENERATOR)
BOTAN_UNUSED(rng);
const BigInt k = generate_rfc6979_nonce(m_x, q, i, m_rfc6979_hash);
const BigInt k = generate_rfc6979_nonce(m_x, q, m, m_rfc6979_hash);
#else
const BigInt k = BigInt::random_integer(rng, 1, q);
#endif

BigInt s = inverse_mod(k, q);
const BigInt k_inv = inverse_mod(k, q);

const BigInt r = m_mod_q.reduce(m_group.power_g_p(k));

s = m_mod_q.multiply(s, mul_add(m_x, r, i));
/*
* Blind the input message and compute x*r+m as (x*r*b + m*b)/b
*/
m_b = m_mod_q.square(m_b);
m_b_inv = m_mod_q.square(m_b_inv);

m = m_mod_q.multiply(m_b, m);
const BigInt xr = m_mod_q.multiply(m_mod_q.multiply(m_x, m_b), r);

const BigInt s = m_mod_q.multiply(m_b_inv, m_mod_q.multiply(k_inv, xr + m));

// With overwhelming probability, a bug rather than actual zero r/s
if(r.is_zero() || s.is_zero())
Expand All @@ -140,7 +157,8 @@ class DSA_Verification_Operation final : public PK_Ops::Verification_with_EMSA
m_group(dsa.get_group()),
m_y(dsa.get_y()),
m_mod_q(dsa.group_q())
{}
{
}

size_t max_input_bits() const override { return m_group.get_q().bits(); }

Expand Down Expand Up @@ -193,12 +211,12 @@ DSA_PublicKey::create_verification_op(const std::string& params,
}

std::unique_ptr<PK_Ops::Signature>
DSA_PrivateKey::create_signature_op(RandomNumberGenerator& /*rng*/,
DSA_PrivateKey::create_signature_op(RandomNumberGenerator& rng,
const std::string& params,
const std::string& provider) const
{
if(provider == "base" || provider.empty())
return std::unique_ptr<PK_Ops::Signature>(new DSA_Signature_Operation(*this, params));
return std::unique_ptr<PK_Ops::Signature>(new DSA_Signature_Operation(*this, params, rng));
throw Provider_Not_Found(algo_name(), provider);
}

Expand Down
20 changes: 20 additions & 0 deletions src/lib/pubkey/ec_group/ec_group.cpp
View file
Expand Up @@ -84,11 +84,21 @@ class EC_Group_Data final

BigInt mod_order(const BigInt& x) const { return m_mod_order.reduce(x); }

BigInt square_mod_order(const BigInt& x) const
{
return m_mod_order.square(x);
}

BigInt multiply_mod_order(const BigInt& x, const BigInt& y) const
{
return m_mod_order.multiply(x, y);
}

BigInt multiply_mod_order(const BigInt& x, const BigInt& y, const BigInt& z) const
{
return m_mod_order.multiply(m_mod_order.multiply(x, y), z);
}

BigInt inverse_mod_order(const BigInt& x) const
{
return inverse_mod(x, m_order);
Expand Down Expand Up @@ -477,11 +487,21 @@ BigInt EC_Group::mod_order(const BigInt& k) const
return data().mod_order(k);
}

BigInt EC_Group::square_mod_order(const BigInt& x) const
{
return data().square_mod_order(x);
}

BigInt EC_Group::multiply_mod_order(const BigInt& x, const BigInt& y) const
{
return data().multiply_mod_order(x, y);
}

BigInt EC_Group::multiply_mod_order(const BigInt& x, const BigInt& y, const BigInt& z) const
{
return data().multiply_mod_order(x, y, z);
}

BigInt EC_Group::inverse_mod_order(const BigInt& x) const
{
return data().inverse_mod_order(x);
Expand Down
10 changes: 10 additions & 0 deletions src/lib/pubkey/ec_group/ec_group.h
View file
Expand Up @@ -203,11 +203,21 @@ class BOTAN_PUBLIC_API(2,0) EC_Group final
*/
BigInt inverse_mod_order(const BigInt& x) const;

/*
* Reduce (x*x) modulo the order
*/
BigInt square_mod_order(const BigInt& x) const;

/*
* Reduce (x*y) modulo the order
*/
BigInt multiply_mod_order(const BigInt& x, const BigInt& y) const;

/*
* Reduce (x*y*z) modulo the order
*/
BigInt multiply_mod_order(const BigInt& x, const BigInt& y, const BigInt& z) const;

/**
* Return the cofactor
* @result the cofactor
Expand Down
29 changes: 22 additions & 7 deletions src/lib/pubkey/ecdsa/ecdsa.cpp
View file
Expand Up @@ -51,14 +51,18 @@ class ECDSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
public:

ECDSA_Signature_Operation(const ECDSA_PrivateKey& ecdsa,
const std::string& emsa) :
const std::string& emsa,
RandomNumberGenerator& rng) :
PK_Ops::Signature_with_EMSA(emsa),
m_group(ecdsa.domain()),
m_x(ecdsa.private_value())
{
#if defined(BOTAN_HAS_RFC6979_GENERATOR)
m_rfc6979_hash = hash_for_emsa(emsa);
#endif

m_b = m_group.random_scalar(rng);
m_b_inv = m_group.inverse_mod_order(m_b);
}

size_t max_input_bits() const override { return m_group.get_order_bits(); }
Expand All @@ -75,6 +79,8 @@ class ECDSA_Signature_Operation final : public PK_Ops::Signature_with_EMSA
#endif

std::vector<BigInt> m_ws;

BigInt m_b, m_b_inv;
};

secure_vector<uint8_t>
Expand All @@ -89,12 +95,21 @@ ECDSA_Signature_Operation::raw_sign(const uint8_t msg[], size_t msg_len,
const BigInt k = m_group.random_scalar(rng);
#endif

const BigInt k_inv = m_group.inverse_mod_order(k);
const BigInt r = m_group.mod_order(
m_group.blinded_base_point_multiply_x(k, rng, m_ws));

const BigInt xrm = m_group.mod_order(m_group.multiply_mod_order(m_x, r) + m);
const BigInt s = m_group.multiply_mod_order(k_inv, xrm);
const BigInt k_inv = m_group.inverse_mod_order(k);

/*
* Blind the input message and compute x*r+m as (x*r*b + m*b)/b
*/
m_b = m_group.square_mod_order(m_b);
m_b_inv = m_group.square_mod_order(m_b_inv);

m = m_group.multiply_mod_order(m_b, m);
const BigInt xr = m_group.multiply_mod_order(m_x, m_b, r);

const BigInt s = m_group.multiply_mod_order(k_inv, xr + m, m_b_inv);

// With overwhelming probability, a bug rather than actual zero r/s
if(r.is_zero() || s.is_zero())
Expand Down Expand Up @@ -144,7 +159,7 @@ bool ECDSA_Verification_Operation::verify(const uint8_t msg[], size_t msg_len,

const BigInt w = m_group.inverse_mod_order(s);

const BigInt u1 = m_group.multiply_mod_order(e, w);
const BigInt u1 = m_group.multiply_mod_order(m_group.mod_order(e), w);
const BigInt u2 = m_group.multiply_mod_order(r, w);
const PointGFp R = m_gy_mul.multi_exp(u1, u2);

Expand Down Expand Up @@ -198,7 +213,7 @@ ECDSA_PublicKey::create_verification_op(const std::string& params,
}

std::unique_ptr<PK_Ops::Signature>
ECDSA_PrivateKey::create_signature_op(RandomNumberGenerator& /*rng*/,
ECDSA_PrivateKey::create_signature_op(RandomNumberGenerator& rng,
const std::string& params,
const std::string& provider) const
{
Expand Down Expand Up @@ -233,7 +248,7 @@ ECDSA_PrivateKey::create_signature_op(RandomNumberGenerator& /*rng*/,
#endif

if(provider == "base" || provider.empty())
return std::unique_ptr<PK_Ops::Signature>(new ECDSA_Signature_Operation(*this, params));
return std::unique_ptr<PK_Ops::Signature>(new ECDSA_Signature_Operation(*this, params, rng));

throw Provider_Not_Found(algo_name(), provider);
}
Expand Down

0 comments on commit 48fc8df

Please sign in to comment.