commit aaa39e97f4c3930f8b4a5d5178b3fe2916321a18
author David Benjamin <davidben@google.com> Thu Jun 16 15:18:38 2016 -0400
committer Adam Langley <agl@google.com> Mon Jun 20 17:17:41 2016 +0000
tree 3593dd547455dfcd9c3ab0201601b64025ce588e
parent 99c752ad52a42b40efd1654f8d506177c38ee1e1

Don't rely on BN_FLG_CONSTTIME in the DSA code.

DSA is deprecated, but get this aligned with some of the BN_FLG_CONSTTIME work
going on elsewhere.

Change-Id: I676ceab298a69362bef1b61d6f597c5c90da2ff0
Reviewed-on: https://boringssl-review.googlesource.com/8309
Reviewed-by: Adam Langley <agl@google.com>

crypto/dsa/dsa.c

diff --git a/crypto/dsa/dsa.c b/crypto/dsa/dsa.c
index 26872d2..5e1f81a 100644
--- a/crypto/dsa/dsa.c
+++ b/crypto/dsa/dsa.c
@@ -442,7 +442,10 @@
   BN_init(&prk);
   BN_with_flags(&prk, priv_key, BN_FLG_CONSTTIME);
 
-  if (!BN_mod_exp(pub_key, dsa->g, &prk, dsa->p, ctx)) {
+  if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p, &dsa->method_mont_lock,
+                              dsa->p, ctx) ||
+      !BN_mod_exp_mont_consttime(pub_key, dsa->g, &prk, dsa->p, ctx,
+                                 dsa->method_mont_p)) {
     goto err;
   }
 
@@ -789,7 +792,7 @@
 int DSA_sign_setup(const DSA *dsa, BN_CTX *ctx_in, BIGNUM **out_kinv,
                    BIGNUM **out_r) {
   BN_CTX *ctx;
-  BIGNUM k, kq, qm2, *K, *kinv = NULL, *r = NULL;
+  BIGNUM k, kq, qm2, *kinv = NULL, *r = NULL;
   int ret = 0;
 
   if (!dsa->p || !dsa->q || !dsa->g) {
@@ -851,9 +854,8 @@
   }
 
   BN_set_flags(&kq, BN_FLG_CONSTTIME);
-  K = &kq;
-
-  if (!BN_mod_exp_mont(r, dsa->g, K, dsa->p, ctx, dsa->method_mont_p)) {
+  if (!BN_mod_exp_mont_consttime(r, dsa->g, &kq, dsa->p, ctx,
+                                 dsa->method_mont_p)) {
     goto err;
   }
   if (!BN_mod(r, r, dsa->q, ctx)) {