You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
161 lines
4.4 KiB
161 lines
4.4 KiB
5 years ago
|
diff --git a/configure.ac b/configure.ac
|
||
|
index 78a3d4e..dfb151e 100644
|
||
|
--- a/configure.ac
|
||
|
+++ b/configure.ac
|
||
|
@@ -645,9 +645,9 @@ if test "x$nettle_cv_fcntl_locking" = "xyes" ; then
|
||
|
fi
|
||
|
|
||
|
# Checks for libraries
|
||
|
-AC_CHECK_LIB(gmp, __gmpz_getlimbn,,
|
||
|
+AC_CHECK_LIB(gmp, __gmpz_powm_sec,,
|
||
|
[AC_MSG_WARN(
|
||
|
-[GNU MP not found, or not 3.1 or up, see http://gmplib.org/.
|
||
|
+[GNU MP not found, or not 5.0 or up, see http://gmplib.org/.
|
||
|
Support for public key algorithms will be unavailable.])]
|
||
|
enable_public_key=no)
|
||
|
|
||
|
diff --git a/dsa-sign.c b/dsa-sign.c
|
||
|
index 0b5ab1d..d0baa27 100644
|
||
|
--- a/dsa-sign.c
|
||
|
+++ b/dsa-sign.c
|
||
|
@@ -54,6 +54,11 @@ _dsa_sign(const struct dsa_public_key *pub,
|
||
|
if (mpz_sizeinbase(pub->q, 2) != 8 * digest_size)
|
||
|
return 0;
|
||
|
|
||
|
+ /* Check that p is odd, so that invalid keys don't result in a crash
|
||
|
+ inside mpz_powm_sec. */
|
||
|
+ if (mpz_even_p (pub->p))
|
||
|
+ return 0;
|
||
|
+
|
||
|
/* Select k, 0<k<q, randomly */
|
||
|
mpz_init_set(tmp, pub->q);
|
||
|
mpz_sub_ui(tmp, tmp, 1);
|
||
|
@@ -63,7 +68,7 @@ _dsa_sign(const struct dsa_public_key *pub,
|
||
|
mpz_add_ui(k, k, 1);
|
||
|
|
||
|
/* Compute r = (g^k (mod p)) (mod q) */
|
||
|
- mpz_powm(tmp, pub->g, k, pub->p);
|
||
|
+ mpz_powm_sec(tmp, pub->g, k, pub->p);
|
||
|
mpz_fdiv_r(signature->r, tmp, pub->q);
|
||
|
|
||
|
/* Compute hash */
|
||
|
diff --git a/rsa-blind.c b/rsa-blind.c
|
||
|
index 97485be..468b68e 100644
|
||
|
--- a/rsa-blind.c
|
||
|
+++ b/rsa-blind.c
|
||
|
@@ -53,7 +53,7 @@ _rsa_blind (const struct rsa_public_key *pub,
|
||
|
while (!mpz_invert (ri, r, pub->n));
|
||
|
|
||
|
/* c = c*(r^e) mod n */
|
||
|
- mpz_powm(r, r, pub->e, pub->n);
|
||
|
+ mpz_powm_sec(r, r, pub->e, pub->n);
|
||
|
mpz_mul(c, c, r);
|
||
|
mpz_fdiv_r(c, c, pub->n);
|
||
|
|
||
|
diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c
|
||
|
index 312b182..4066619 100644
|
||
|
--- a/rsa-decrypt-tr.c
|
||
|
+++ b/rsa-decrypt-tr.c
|
||
|
@@ -43,6 +43,9 @@ rsa_decrypt_tr(const struct rsa_public_key *pub,
|
||
|
mpz_t m, ri;
|
||
|
int res;
|
||
|
|
||
|
+ if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q))
|
||
|
+ return 0;
|
||
|
+
|
||
|
mpz_init_set(m, gibberish);
|
||
|
mpz_init (ri);
|
||
|
|
||
|
diff --git a/rsa-decrypt.c b/rsa-decrypt.c
|
||
|
index a3abf6e..64d12ae 100644
|
||
|
--- a/rsa-decrypt.c
|
||
|
+++ b/rsa-decrypt.c
|
||
|
@@ -39,6 +39,9 @@ rsa_decrypt(const struct rsa_private_key *key,
|
||
|
mpz_t m;
|
||
|
int res;
|
||
|
|
||
|
+ if (mpz_even_p (key->p) || mpz_even_p (key->q))
|
||
|
+ return 0;
|
||
|
+
|
||
|
mpz_init(m);
|
||
|
rsa_compute_root(key, m, gibberish);
|
||
|
|
||
|
diff --git a/rsa-pkcs1-sign-tr.c b/rsa-pkcs1-sign-tr.c
|
||
|
index 5efc155..0031706 100644
|
||
|
--- a/rsa-pkcs1-sign-tr.c
|
||
|
+++ b/rsa-pkcs1-sign-tr.c
|
||
|
@@ -40,6 +40,9 @@ rsa_pkcs1_sign_tr(const struct rsa_public_key *pub,
|
||
|
{
|
||
|
mpz_t ri;
|
||
|
|
||
|
+ if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q))
|
||
|
+ return 0;
|
||
|
+
|
||
|
if (pkcs1_rsa_digest_encode (s, key->size, length, digest_info))
|
||
|
{
|
||
|
mpz_init (ri);
|
||
|
diff --git a/rsa-pkcs1-sign.c b/rsa-pkcs1-sign.c
|
||
|
index 9162cfc..e39485b 100644
|
||
|
--- a/rsa-pkcs1-sign.c
|
||
|
+++ b/rsa-pkcs1-sign.c
|
||
|
@@ -36,6 +36,9 @@ rsa_pkcs1_sign(const struct rsa_private_key *key,
|
||
|
unsigned length, const uint8_t *digest_info,
|
||
|
mpz_t s)
|
||
|
{
|
||
|
+ if (mpz_even_p (key->p) || mpz_even_p (key->q))
|
||
|
+ return 0;
|
||
|
+
|
||
|
if (pkcs1_rsa_digest_encode (s, key->size, length, digest_info))
|
||
|
{
|
||
|
rsa_compute_root(key, s, s);
|
||
|
diff --git a/rsa-sign.c b/rsa-sign.c
|
||
|
index 56adda3..9f2a707 100644
|
||
|
--- a/rsa-sign.c
|
||
|
+++ b/rsa-sign.c
|
||
|
@@ -88,11 +88,11 @@ rsa_compute_root(const struct rsa_private_key *key,
|
||
|
|
||
|
/* Compute xq = m^d % q = (m%q)^b % q */
|
||
|
mpz_fdiv_r(xq, m, key->q);
|
||
|
- mpz_powm(xq, xq, key->b, key->q);
|
||
|
+ mpz_powm_sec(xq, xq, key->b, key->q);
|
||
|
|
||
|
/* Compute xp = m^d % p = (m%p)^a % p */
|
||
|
mpz_fdiv_r(xp, m, key->p);
|
||
|
- mpz_powm(xp, xp, key->a, key->p);
|
||
|
+ mpz_powm_sec(xp, xp, key->a, key->p);
|
||
|
|
||
|
/* Set xp' = (xp - xq) c % p. */
|
||
|
mpz_sub(xp, xp, xq);
|
||
|
diff --git a/rsa.c b/rsa.c
|
||
|
index e303a8c..91b3f85 100644
|
||
|
--- a/rsa.c
|
||
|
+++ b/rsa.c
|
||
|
@@ -58,6 +58,9 @@ _rsa_check_size(mpz_t n)
|
||
|
/* Round upwards */
|
||
|
unsigned size = (mpz_sizeinbase(n, 2) + 7) / 8;
|
||
|
|
||
|
+ if (mpz_even_p (n))
|
||
|
+ return 0;
|
||
|
+
|
||
|
if (size < RSA_MINIMUM_N_OCTETS)
|
||
|
return 0;
|
||
|
|
||
|
diff --git a/testsuite/rsa-test.c b/testsuite/rsa-test.c
|
||
|
index e9b1c03..a429664 100644
|
||
|
--- a/testsuite/rsa-test.c
|
||
|
+++ b/testsuite/rsa-test.c
|
||
|
@@ -57,6 +57,13 @@ test_main(void)
|
||
|
|
||
|
test_rsa_sha512(&pub, &key, expected);
|
||
|
|
||
|
+ /* Test detection of invalid keys with even modulo */
|
||
|
+ mpz_clrbit (pub.n, 0);
|
||
|
+ ASSERT (!rsa_public_key_prepare (&pub));
|
||
|
+
|
||
|
+ mpz_clrbit (key.p, 0);
|
||
|
+ ASSERT (!rsa_private_key_prepare (&key));
|
||
|
+
|
||
|
/* 777-bit key, generated by
|
||
|
*
|
||
|
* lsh-keygen -a rsa -l 777 -f advanced-hex
|