)]}'
{
  "commit": "55b069de8d3ed53fe578fde5c15499cc4c177af5",
  "tree": "ed9a864a5c3c9c9bf39fa2caa10cb4cb28eea8cc",
  "parents": [
    "6cf98208371e5c2c8b9d34ce3b8c452ea90e2963"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri May 26 15:06:27 2023 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Wed May 31 21:32:59 2023 +0000"
  },
  "message": "Add a value barrier when checking for point doubling.\n\nMany of our point addition functions internally check for the doubling\ncase and branch because the addition formulas are incomplete. This\nbranch is fine because the multiplication formulas are arranged to not\nhit this case. However, we don\u0027t want to leak the couple of intermedate\nvalues that determine whether to branch. Previously, we ran into this\nwith https://boringssl-review.googlesource.com/c/boringssl/+/36465.\n\nThis wasn\u0027t sufficient. The compiler understands if (a \u0026 b) enough to\ncompile into two branches. Thanks to Moritz Schneider, Nicolas Dutly,\nDaniele Lain, Ivan Puddu, and Srdjan Capkun for reporting this!\n\nFix the leak by adding a value barrier on the final value. As we\u0027re also\nintentionally leaking the result of otherwise secret data flow, I\u0027ve\nused the constant_time_declassify functions, which feed into our\nvalgrind-based constant-time validation and double as barriers.\n\nAccordingly, I\u0027ve also added some CONSTTIME_SECRET markers around the\nECDSA nonce value, so we can check with valgrind the fix worked. The\nmarker really should be at a lower level, at ec_random_nonzero_scalar or\nfurther (maybe RAND_bytes?), but for now I\u0027ve just marked the nonce.\nTo then clear valgrind, add constant_time_declassify in a few other\nplaces, like trying to convert infinity to affine coordinates. (ECDH\ndeals with secret points, but it is public that the point isn\u0027t\ninfinity.)\n\nValgrind now says this code is constant-time, at least up to compilation\ndifferences introduced by the annotations. I\u0027ve also inspected the\ncompiler output. This seems to be fine, though neither test is quite\nsatisfying. Ideally we could add annotations in ways that don\u0027t\ninfluence compiler output.\n\nChange-Id: Idfc413a75d92514717520404a0f5424903cb4453\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/60225\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2195d065f647dbd8140b568f4369175d5cdb4f83",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/ec.c",
      "new_id": "04f2a983d9bfa991069f8f0470e74bf8327ccb3c",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/ec.c"
    },
    {
      "type": "modify",
      "old_id": "eeaee64ca9c6b903c880ceb87004b414de203070",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/ec_montgomery.c",
      "new_id": "78e0507699544e3b7d3138d556b2c1877a7f6ce7",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/ec_montgomery.c"
    },
    {
      "type": "modify",
      "old_id": "853202638a2c4eedb6705b3c58d21e00e13bc630",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/internal.h",
      "new_id": "bb41815159e69798f460bee6f575acaa433d5546",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/internal.h"
    },
    {
      "type": "modify",
      "old_id": "ef83b2912b337cd0eadc128f87a09e4a4a120075",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/p224-64.c",
      "new_id": "b646e8216dd016a2a4756fcdcdfea81629b4b89a",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/p224-64.c"
    },
    {
      "type": "modify",
      "old_id": "dfde2f48f90f16098027e41dd5b5295bf1f061b0",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/p256-nistz.c",
      "new_id": "85343fd95c56e28887feffbae413c56e0ad6f8df",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/p256-nistz.c"
    },
    {
      "type": "modify",
      "old_id": "af211be333760fbeddf14844c78b9cde358cd1a5",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ec/p256.c",
      "new_id": "76e865f33a218a0444582b05cb51c8f8c705a24d",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ec/p256.c"
    },
    {
      "type": "modify",
      "old_id": "be1954066a14a82535325a6b322b450e24105004",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/ecdsa/ecdsa.c",
      "new_id": "1be147f93b4d8a9a8e8c5e7246580e197560116f",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/ecdsa/ecdsa.c"
    }
  ]
}