)]}'
{
  "commit": "7139f755b6aeadece62d576278e2fd97983229ac",
  "tree": "2f3b48f86ebf27ecb1fceff37f53281ff6434109",
  "parents": [
    "9f9c938af0affceee30eef308ed2596e1d7f53e0"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Thu Jun 07 11:32:15 2018 -0400"
  },
  "committer": {
    "name": "CQ bot account: commit-bot@chromium.org",
    "email": "commit-bot@chromium.org",
    "time": "Fri Jun 15 02:37:45 2018 +0000"
  },
  "message": "Fix some timing leaks in the DSA code.\n\nThe DSA code is deprecated and will, hopefully, be removed in the future.\nNonetheless, this is easy enough to fix. It\u0027s the analog of the work we\u0027d\nalready done for ECDSA.\n\n- Document more clearly that we don\u0027t care about the DSA code.\n\n- Use the existing constant-time modular addition function rather than\n  the ad-hoc code.\n\n- Reduce the digest to satisfy modular operations\u0027 invariants. (The\n  underlying algorithms could accept looser bounds, but we reduce for\n  simplicity.) There\u0027s no particular reason to do this in constant time,\n  but we have the code for it, so we may as well.\n\n- This additionally adds a missing check that num_bits(q) is a multiple\n  of 8. We otherwise don\u0027t compute the right answer. Verification\n  already rejected all 160-, 224-, and 256-bit keys, and we only\n  generate DSA parameters where the length of q matches some hash\n  function\u0027s length, so this is unlikely to cause anyone trouble.\n\n- Use Montgomery reduction to perform the modular multiplication. This\n  could be optimized to save a couple Montgomery reductions as in ECDSA,\n  but DSA is deprecated, so I haven\u0027t bothered optimizing this.\n\n- The reduction from g^k (mod p) to r \u003d g^k (mod p) (mod q) is left\n  in variable time, but reversing it would require a discrete log\n  anyway. (The corresponding ECDSA operation is much easier to make\n  constant-time due to Hasse\u0027s theorem, though that\u0027s actually still a\n  TODO. I need to finish lifting EC_FELEM up the stack.)\n\nThanks to Keegan Ryan from NCC Group for reporting the modular addition issue\n(CVE-2018-0495). The remainder is stuff I noticed along the way.\n\nUpdate-Note: See the num_bits(q) change.\n\nChange-Id: I4f032b041e2aeb09f9737a39f178c24e6a7fa1cb\nReviewed-on: https://boringssl-review.googlesource.com/29145\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\nCQ-Verified: CQ bot account: commit-bot@chromium.org \u003ccommit-bot@chromium.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b97806b8482b1b41a30715e849eb91e255fa87e9",
      "old_mode": 33188,
      "old_path": "crypto/dsa/dsa.c",
      "new_id": "7adde072deb2bbefc9c44a3dcacc13c90a77e0bc",
      "new_mode": 33188,
      "new_path": "crypto/dsa/dsa.c"
    },
    {
      "type": "modify",
      "old_id": "2966f9d5f7a599d16c98d835a7ce5e19c63f0568",
      "old_mode": 33188,
      "old_path": "include/openssl/dsa.h",
      "new_id": "a5fa7678780788abc149f0071a869c8bdb43d80f",
      "new_mode": 33188,
      "new_path": "include/openssl/dsa.h"
    }
  ]
}