You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
160 lines
4.4 KiB
160 lines
4.4 KiB
diff --git a/configure.ac b/configure.ac |
|
index 78a3d4e..dfb151e 100644 |
|
--- a/configure.ac |
|
+++ b/configure.ac |
|
@@ -645,9 +645,9 @@ if test "x$nettle_cv_fcntl_locking" = "xyes" ; then |
|
fi |
|
|
|
# Checks for libraries |
|
-AC_CHECK_LIB(gmp, __gmpz_getlimbn,, |
|
+AC_CHECK_LIB(gmp, __gmpz_powm_sec,, |
|
[AC_MSG_WARN( |
|
-[GNU MP not found, or not 3.1 or up, see http://gmplib.org/. |
|
+[GNU MP not found, or not 5.0 or up, see http://gmplib.org/. |
|
Support for public key algorithms will be unavailable.])] |
|
enable_public_key=no) |
|
|
|
diff --git a/dsa-sign.c b/dsa-sign.c |
|
index 0b5ab1d..d0baa27 100644 |
|
--- a/dsa-sign.c |
|
+++ b/dsa-sign.c |
|
@@ -54,6 +54,11 @@ _dsa_sign(const struct dsa_public_key *pub, |
|
if (mpz_sizeinbase(pub->q, 2) != 8 * digest_size) |
|
return 0; |
|
|
|
+ /* Check that p is odd, so that invalid keys don't result in a crash |
|
+ inside mpz_powm_sec. */ |
|
+ if (mpz_even_p (pub->p)) |
|
+ return 0; |
|
+ |
|
/* Select k, 0<k<q, randomly */ |
|
mpz_init_set(tmp, pub->q); |
|
mpz_sub_ui(tmp, tmp, 1); |
|
@@ -63,7 +68,7 @@ _dsa_sign(const struct dsa_public_key *pub, |
|
mpz_add_ui(k, k, 1); |
|
|
|
/* Compute r = (g^k (mod p)) (mod q) */ |
|
- mpz_powm(tmp, pub->g, k, pub->p); |
|
+ mpz_powm_sec(tmp, pub->g, k, pub->p); |
|
mpz_fdiv_r(signature->r, tmp, pub->q); |
|
|
|
/* Compute hash */ |
|
diff --git a/rsa-blind.c b/rsa-blind.c |
|
index 97485be..468b68e 100644 |
|
--- a/rsa-blind.c |
|
+++ b/rsa-blind.c |
|
@@ -53,7 +53,7 @@ _rsa_blind (const struct rsa_public_key *pub, |
|
while (!mpz_invert (ri, r, pub->n)); |
|
|
|
/* c = c*(r^e) mod n */ |
|
- mpz_powm(r, r, pub->e, pub->n); |
|
+ mpz_powm_sec(r, r, pub->e, pub->n); |
|
mpz_mul(c, c, r); |
|
mpz_fdiv_r(c, c, pub->n); |
|
|
|
diff --git a/rsa-decrypt-tr.c b/rsa-decrypt-tr.c |
|
index 312b182..4066619 100644 |
|
--- a/rsa-decrypt-tr.c |
|
+++ b/rsa-decrypt-tr.c |
|
@@ -43,6 +43,9 @@ rsa_decrypt_tr(const struct rsa_public_key *pub, |
|
mpz_t m, ri; |
|
int res; |
|
|
|
+ if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q)) |
|
+ return 0; |
|
+ |
|
mpz_init_set(m, gibberish); |
|
mpz_init (ri); |
|
|
|
diff --git a/rsa-decrypt.c b/rsa-decrypt.c |
|
index a3abf6e..64d12ae 100644 |
|
--- a/rsa-decrypt.c |
|
+++ b/rsa-decrypt.c |
|
@@ -39,6 +39,9 @@ rsa_decrypt(const struct rsa_private_key *key, |
|
mpz_t m; |
|
int res; |
|
|
|
+ if (mpz_even_p (key->p) || mpz_even_p (key->q)) |
|
+ return 0; |
|
+ |
|
mpz_init(m); |
|
rsa_compute_root(key, m, gibberish); |
|
|
|
diff --git a/rsa-pkcs1-sign-tr.c b/rsa-pkcs1-sign-tr.c |
|
index 5efc155..0031706 100644 |
|
--- a/rsa-pkcs1-sign-tr.c |
|
+++ b/rsa-pkcs1-sign-tr.c |
|
@@ -40,6 +40,9 @@ rsa_pkcs1_sign_tr(const struct rsa_public_key *pub, |
|
{ |
|
mpz_t ri; |
|
|
|
+ if (mpz_even_p (pub->n) || mpz_even_p (key->p) || mpz_even_p (key->q)) |
|
+ return 0; |
|
+ |
|
if (pkcs1_rsa_digest_encode (s, key->size, length, digest_info)) |
|
{ |
|
mpz_init (ri); |
|
diff --git a/rsa-pkcs1-sign.c b/rsa-pkcs1-sign.c |
|
index 9162cfc..e39485b 100644 |
|
--- a/rsa-pkcs1-sign.c |
|
+++ b/rsa-pkcs1-sign.c |
|
@@ -36,6 +36,9 @@ rsa_pkcs1_sign(const struct rsa_private_key *key, |
|
unsigned length, const uint8_t *digest_info, |
|
mpz_t s) |
|
{ |
|
+ if (mpz_even_p (key->p) || mpz_even_p (key->q)) |
|
+ return 0; |
|
+ |
|
if (pkcs1_rsa_digest_encode (s, key->size, length, digest_info)) |
|
{ |
|
rsa_compute_root(key, s, s); |
|
diff --git a/rsa-sign.c b/rsa-sign.c |
|
index 56adda3..9f2a707 100644 |
|
--- a/rsa-sign.c |
|
+++ b/rsa-sign.c |
|
@@ -88,11 +88,11 @@ rsa_compute_root(const struct rsa_private_key *key, |
|
|
|
/* Compute xq = m^d % q = (m%q)^b % q */ |
|
mpz_fdiv_r(xq, m, key->q); |
|
- mpz_powm(xq, xq, key->b, key->q); |
|
+ mpz_powm_sec(xq, xq, key->b, key->q); |
|
|
|
/* Compute xp = m^d % p = (m%p)^a % p */ |
|
mpz_fdiv_r(xp, m, key->p); |
|
- mpz_powm(xp, xp, key->a, key->p); |
|
+ mpz_powm_sec(xp, xp, key->a, key->p); |
|
|
|
/* Set xp' = (xp - xq) c % p. */ |
|
mpz_sub(xp, xp, xq); |
|
diff --git a/rsa.c b/rsa.c |
|
index e303a8c..91b3f85 100644 |
|
--- a/rsa.c |
|
+++ b/rsa.c |
|
@@ -58,6 +58,9 @@ _rsa_check_size(mpz_t n) |
|
/* Round upwards */ |
|
unsigned size = (mpz_sizeinbase(n, 2) + 7) / 8; |
|
|
|
+ if (mpz_even_p (n)) |
|
+ return 0; |
|
+ |
|
if (size < RSA_MINIMUM_N_OCTETS) |
|
return 0; |
|
|
|
diff --git a/testsuite/rsa-test.c b/testsuite/rsa-test.c |
|
index e9b1c03..a429664 100644 |
|
--- a/testsuite/rsa-test.c |
|
+++ b/testsuite/rsa-test.c |
|
@@ -57,6 +57,13 @@ test_main(void) |
|
|
|
test_rsa_sha512(&pub, &key, expected); |
|
|
|
+ /* Test detection of invalid keys with even modulo */ |
|
+ mpz_clrbit (pub.n, 0); |
|
+ ASSERT (!rsa_public_key_prepare (&pub)); |
|
+ |
|
+ mpz_clrbit (key.p, 0); |
|
+ ASSERT (!rsa_private_key_prepare (&key)); |
|
+ |
|
/* 777-bit key, generated by |
|
* |
|
* lsh-keygen -a rsa -l 777 -f advanced-hex
|
|
|