diff options
| author | Werner Koch <wk@gnupg.org> | 2013-12-16 09:22:10 +0100 |
|---|---|---|
| committer | Werner Koch <wk@gnupg.org> | 2013-12-16 11:44:25 +0100 |
| commit | dec048b2ec79271a2f4405be5b87b1e768b3f1a9 (patch) | |
| tree | ba943d5e91b7d0705005414c62c455efeb140791 /cipher/dsa.c | |
| parent | 953535a7de68cf62b5b1ad6f96ea3a9edd83762c (diff) | |
| download | libgcrypt-dec048b2ec79271a2f4405be5b87b1e768b3f1a9.tar.gz | |
cipher: Normalize the MPIs used as input to secret key functions.
* cipher/dsa.c (sign): Normalize INPUT.
* cipher/elgamal.c (decrypt): Normalize A and B.
* cipher/rsa.c (secret): Normalize the INPUT.
(rsa_decrypt): Reduce DATA before passing to secret.
--
mpi_normalize is in general not required because extra leading zeroes
do not harm the computation. However, adding extra all zero limbs or
padding with multiples of N may be useful in side-channel attacks.
This is an extra pre-caution in case RSA blinding has been disabled.
CVE-id: CVE-2013-4576
Signed-off-by: Werner Koch <wk@gnupg.org>
Diffstat (limited to 'cipher/dsa.c')
| -rw-r--r-- | cipher/dsa.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/cipher/dsa.c b/cipher/dsa.c index 5d29ba42..50bdab16 100644 --- a/cipher/dsa.c +++ b/cipher/dsa.c @@ -583,7 +583,10 @@ sign (gcry_mpi_t r, gcry_mpi_t s, gcry_mpi_t input, DSA_secret_key *skey, mpi_rshift (hash, hash, abits - qbits); } else - hash = input; + { + mpi_normalize (input); + hash = input; + } again: /* Create the K value. */ |