cipher: Normalize the MPIs used as input to secret key functions.

* cipher/dsa.c (sign): Normalize INPUT.
* cipher/elgamal.c (decrypt): Normalize A and B.
* cipher/rsa.c (secret): Normalize the INPUT.
(rsa_decrypt): Reduce DATA before passing to secret.
--

mpi_normalize is in general not required because extra leading zeroes
do not harm the computation.  However, adding extra all zero limbs or
padding with multiples of N may be useful in side-channel attacks.
This is an extra pre-caution in case RSA blinding has been disabled.

CVE-id: CVE-2013-4576
Signed-off-by: Werner Koch <wk@gnupg.org>

1 files changed, 10 insertions, 0 deletions

diff --git a/cipher/rsa.c b/cipher/rsa.c
index a97dcfd0..e595e386 100644
--- a/cipher/rsa.c
+++ b/cipher/rsa.c
@@ -712,6 +712,9 @@ stronger_key_check ( RSA_secret_key *skey )
 static void
 secret (gcry_mpi_t output, gcry_mpi_t input, RSA_secret_key *skey )
 {
+  /* Remove superfluous leading zeroes from INPUT.  */
+  mpi_normalize (input);
+
   if (!skey->p || !skey->q || !skey->u)
     {
       mpi_powm (output, input, skey->d, skey->n);
@@ -997,6 +1000,13 @@ rsa_decrypt (gcry_sexp_t *r_plain, gcry_sexp_t s_data, gcry_sexp_t keyparms)
         }
     }
 
+  /* Better make sure that there are no superfluous leading zeroes in
+     the input and it has not been "padded" using multiples of N.
+     This mitigates side-channel attacks (CVE-2013-4576).  */
+  mpi_normalize (data);
+  mpi_fdiv_r (data, data, sk.n);
+
+  /* Allocate MPI for the plaintext.  */
   plain = mpi_snew (ctx.nbits);
 
   /* We use blinding by default to mitigate timing attacks which can