Convert big.Int to bignum via word slice #25
Conversation
|
What is the advantage of removing |
| @@ -180,6 +180,9 @@ DEFINEFUNC(void, BN_clear_free, (GO_BIGNUM_PTR arg0), (arg0)) \ | |||
| DEFINEFUNC(int, BN_num_bits, (const GO_BIGNUM_PTR arg0), (arg0)) \ | |||
| DEFINEFUNC(GO_BIGNUM_PTR, BN_bin2bn, (const unsigned char *arg0, int arg1, GO_BIGNUM_PTR arg2), (arg0, arg1, arg2)) \ | |||
| DEFINEFUNC(int, BN_bn2bin, (const GO_BIGNUM_PTR arg0, unsigned char *arg1), (arg0, arg1)) \ | |||
| /* bn_lebin2bn and bn_bn2lebinpad are not exported in any OpenSSL 1.0.2, but they exist. */ \ | |||
| /*check:from=1.1.0*/ DEFINEFUNC_RENAMED_1_1(GO_BIGNUM_PTR, BN_lebin2bn, bn_lebin2bn, (const unsigned char *s, int len, GO_BIGNUM_PTR ret), (s, len, ret)) \ | |||
| /*check:from=1.1.0*/ DEFINEFUNC_RENAMED_1_1(int, BN_bn2lebinpad, bn_bn2lebinpad, (const GO_BIGNUM_PTR a, unsigned char *to, int tolen), (a, to, tolen)) \ | |||
There was a problem hiding this comment.
/*check:from=1.1.0*/
What impact does this have?
There was a problem hiding this comment.
checkheader won't validate that the signature defined here matches the one in the official OpenSSL headers when testing with OpenSSL 1.0.2. We can only trust on the developer copy-past skills.
It does not have any runtime impact.
The Go security team is trying to reduce the usage of This is the commit were And these are other issues related to removing
In our case, it will make security reviews a little bit easier, as by removing |
| @@ -180,6 +180,9 @@ DEFINEFUNC(void, BN_clear_free, (GO_BIGNUM_PTR arg0), (arg0)) \ | |||
| DEFINEFUNC(int, BN_num_bits, (const GO_BIGNUM_PTR arg0), (arg0)) \ | |||
| DEFINEFUNC(GO_BIGNUM_PTR, BN_bin2bn, (const unsigned char *arg0, int arg1, GO_BIGNUM_PTR arg2), (arg0, arg1, arg2)) \ | |||
| DEFINEFUNC(int, BN_bn2bin, (const GO_BIGNUM_PTR arg0, unsigned char *arg1), (arg0, arg1)) \ | |||
| /* bn_lebin2bn and bn_bn2lebinpad are not exported in any OpenSSL 1.0.2, but they exist. */ \ | |||
There was a problem hiding this comment.
Out of curiosity, I found that these were ported to 1.0.2 in 2019 by openssl/openssl#9793 to support a constant-time fix.
This PR is an almost direct port of https://go-review.googlesource.com/c/go/+/395875/10. In our case there is no visible performance win, which was the motivation of the original CL, but it paves the path to removing
big.Intfromgo-crypto-openssl, which is necessary for go1.19.