)]}' { "commit": "8017cdde38681f1deee85b9818d971b686e075ff", "tree": "95b3704fabb97a8b62cd1f2b3fdde48ccfc022ba", "parents": [ "b9f30bb6feba179bba0b7c61af8fad8ed305f1e5" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon Jan 22 10:44:50 2018 -0500" }, "committer": { "name": "Adam Langley", "email": "agl@google.com", "time": "Tue Jan 23 22:14:54 2018 +0000" }, "message": "Make BN_num_bits_word constant-time.\n\n(The BN_num_bits_word implementation was originally written by Andy\nPolyakov for OpenSSL. See also\nhttps://github.com/openssl/openssl/pull/5154.)\n\nBN_num_bits, by way of BN_num_bits_word, currently leaks the\nmost-significant word of its argument via branching and memory access\npattern.\n\nBN_num_bits is called on RSA prime factors in various places. These have\npublic bit lengths, but all bits beyond the high bit are secret. This\nfully resolves those cases.\n\nThere are a few places where BN_num_bits is called on an input where\nthe bit length is also secret. The two left in BoringSSL are:\n\n- BN_mod_exp_mont_consttime calls it on the RSA private exponent.\n\n- The timing \"fix\" to add the order to k in DSA.\n\nThis does *not* fully resolve those cases as we still only look at the\ntop word. Today, that is guaranteed to be non-zero, but only because of\nthe long-standing bn_correct_top timing leak. Once that is fixed (I hope\nto have patches soon), a constant-time BN_num_bits on such inputs must\ncount bits on each word.\n\nInstead, those cases should not call BN_num_bits at all. The former uses\nthe bit width to pick windows, but it should be using the maximum bit\nwidth. The next patch will fix this. The latter is the same \"fix\" we\nexcised from ECDSA in a838f9dc7e6cc091237f0acbbe4953104104e815. That\nshould be excised from DSA after the bn_correct_top bug is fixed.\n\nThanks to Dinghao Wu, Danfeng Zhang, Shuai Wang, Pei Wang, and Xiao Liu\nfor reporting this issue.\n\nChange-Id: Idc3da518cc5ec18bd8688b95f959b15300a57c14\nReviewed-on: https://boringssl-review.googlesource.com/25184\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "4ed6ab056b37850e212716aa09ee6a085cfa571f", "old_mode": 33188, "old_path": "crypto/fipsmodule/bn/bn.c", "new_id": "4be4f21c80f5255e98d840fd1de3bdc2c2f51911", "new_mode": 33188, "new_path": "crypto/fipsmodule/bn/bn.c" }, { "type": "modify", "old_id": "8e156ad59af096bf52a58f04e142752f0ec089f0", "old_mode": 33188, "old_path": "crypto/fipsmodule/bn/bn_test.cc", "new_id": "ca5f978d551c7915c3d613918dcf52b1026b8276", "new_mode": 33188, "new_path": "crypto/fipsmodule/bn/bn_test.cc" } ] }