| commit | db10ae50361a05508683282fcd8d2344a6a1517c | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Sat Nov 19 01:17:49 2022 -0500 |
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | Tue Nov 29 01:13:51 2022 +0000 |
| tree | 1062757a50e405e886d0600d6fa6c6ca13c3faf6 | |
| parent | de434576d7412b95a8eb90d613fc9f01e2d7166b [diff] |
Cap Montgomery moduli to 8 KiB. We have two places where the current cap on BIGNUM sizes (64 MiB) is too large, both involving Montgomery reduction: bn_mul_mont allocates a spare value on the stack, and BN_mod_exp_mont_constime needs to allocate a buffer of up to 64 contiguous values, which may overflow an int. Make BN_MONT_CTX reject any BIGNUM larger than 8 KiB. This is 65,536 bits which is well above our maximum RSA key size, 16,384 bits. Ideally we'd just apply this in bn_wexpand, to all BIGNUMs across the board, but we found one caller that depends on creating an 8 MiB BIGNUM. Update-Note: This will not affect any cryptography implemented by BoringSSL, such as RSA, but other callers may run into this limit. If necessary, we can raise this a bit, but the stack allocation means we don't want to go *significantly* beyond what's in this CL. Fixed: 541 Change-Id: Ia00f3ea6714a5042434f446943db55a533752dc5 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/55266 Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
There are other files in this directory which might be helpful: