xref: /openssl/crypto/bn/bn_blind.c (revision da1c088f)
1 /*
2  * Copyright 1998-2023 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <openssl/opensslconf.h>
11 #include "internal/cryptlib.h"
12 #include "bn_local.h"
13 
14 #define BN_BLINDING_COUNTER     32
15 
16 struct bn_blinding_st {
17     BIGNUM *A;
18     BIGNUM *Ai;
19     BIGNUM *e;
20     BIGNUM *mod;                /* just a reference */
21     CRYPTO_THREAD_ID tid;
22     int counter;
23     unsigned long flags;
24     BN_MONT_CTX *m_ctx;
25     int (*bn_mod_exp) (BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
26                        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
27     CRYPTO_RWLOCK *lock;
28 };
29 
BN_BLINDING_new(const BIGNUM * A,const BIGNUM * Ai,BIGNUM * mod)30 BN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod)
31 {
32     BN_BLINDING *ret = NULL;
33 
34     bn_check_top(mod);
35 
36     if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)
37         return NULL;
38 
39     ret->lock = CRYPTO_THREAD_lock_new();
40     if (ret->lock == NULL) {
41         ERR_raise(ERR_LIB_BN, ERR_R_CRYPTO_LIB);
42         OPENSSL_free(ret);
43         return NULL;
44     }
45 
46     BN_BLINDING_set_current_thread(ret);
47 
48     if (A != NULL) {
49         if ((ret->A = BN_dup(A)) == NULL)
50             goto err;
51     }
52 
53     if (Ai != NULL) {
54         if ((ret->Ai = BN_dup(Ai)) == NULL)
55             goto err;
56     }
57 
58     /* save a copy of mod in the BN_BLINDING structure */
59     if ((ret->mod = BN_dup(mod)) == NULL)
60         goto err;
61 
62     if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
63         BN_set_flags(ret->mod, BN_FLG_CONSTTIME);
64 
65     /*
66      * Set the counter to the special value -1 to indicate that this is
67      * never-used fresh blinding that does not need updating before first
68      * use.
69      */
70     ret->counter = -1;
71 
72     return ret;
73 
74  err:
75     BN_BLINDING_free(ret);
76     return NULL;
77 }
78 
BN_BLINDING_free(BN_BLINDING * r)79 void BN_BLINDING_free(BN_BLINDING *r)
80 {
81     if (r == NULL)
82         return;
83     BN_free(r->A);
84     BN_free(r->Ai);
85     BN_free(r->e);
86     BN_free(r->mod);
87     CRYPTO_THREAD_lock_free(r->lock);
88     OPENSSL_free(r);
89 }
90 
BN_BLINDING_update(BN_BLINDING * b,BN_CTX * ctx)91 int BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx)
92 {
93     int ret = 0;
94 
95     if ((b->A == NULL) || (b->Ai == NULL)) {
96         ERR_raise(ERR_LIB_BN, BN_R_NOT_INITIALIZED);
97         goto err;
98     }
99 
100     if (b->counter == -1)
101         b->counter = 0;
102 
103     if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL &&
104         !(b->flags & BN_BLINDING_NO_RECREATE)) {
105         /* re-create blinding parameters */
106         if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
107             goto err;
108     } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {
109         if (b->m_ctx != NULL) {
110             if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx)
111                 || !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx))
112                 goto err;
113         } else {
114             if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)
115                 || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))
116                 goto err;
117         }
118     }
119 
120     ret = 1;
121  err:
122     if (b->counter == BN_BLINDING_COUNTER)
123         b->counter = 0;
124     return ret;
125 }
126 
BN_BLINDING_convert(BIGNUM * n,BN_BLINDING * b,BN_CTX * ctx)127 int BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
128 {
129     return BN_BLINDING_convert_ex(n, NULL, b, ctx);
130 }
131 
BN_BLINDING_convert_ex(BIGNUM * n,BIGNUM * r,BN_BLINDING * b,BN_CTX * ctx)132 int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
133 {
134     int ret = 1;
135 
136     bn_check_top(n);
137 
138     if ((b->A == NULL) || (b->Ai == NULL)) {
139         ERR_raise(ERR_LIB_BN, BN_R_NOT_INITIALIZED);
140         return 0;
141     }
142 
143     if (b->counter == -1)
144         /* Fresh blinding, doesn't need updating. */
145         b->counter = 0;
146     else if (!BN_BLINDING_update(b, ctx))
147         return 0;
148 
149     if (r != NULL && (BN_copy(r, b->Ai) == NULL))
150         return 0;
151 
152     if (b->m_ctx != NULL)
153         ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);
154     else
155         ret = BN_mod_mul(n, n, b->A, b->mod, ctx);
156 
157     return ret;
158 }
159 
BN_BLINDING_invert(BIGNUM * n,BN_BLINDING * b,BN_CTX * ctx)160 int BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx)
161 {
162     return BN_BLINDING_invert_ex(n, NULL, b, ctx);
163 }
164 
BN_BLINDING_invert_ex(BIGNUM * n,const BIGNUM * r,BN_BLINDING * b,BN_CTX * ctx)165 int BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b,
166                           BN_CTX *ctx)
167 {
168     int ret;
169 
170     bn_check_top(n);
171 
172     if (r == NULL && (r = b->Ai) == NULL) {
173         ERR_raise(ERR_LIB_BN, BN_R_NOT_INITIALIZED);
174         return 0;
175     }
176 
177     if (b->m_ctx != NULL) {
178         /* ensure that BN_mod_mul_montgomery takes pre-defined path */
179         if (n->dmax >= r->top) {
180             size_t i, rtop = r->top, ntop = n->top;
181             BN_ULONG mask;
182 
183             for (i = 0; i < rtop; i++) {
184                 mask = (BN_ULONG)0 - ((i - ntop) >> (8 * sizeof(i) - 1));
185                 n->d[i] &= mask;
186             }
187             mask = (BN_ULONG)0 - ((rtop - ntop) >> (8 * sizeof(ntop) - 1));
188             /* always true, if (rtop >= ntop) n->top = r->top; */
189             n->top = (int)(rtop & ~mask) | (ntop & mask);
190             n->flags |= (BN_FLG_FIXED_TOP & ~mask);
191         }
192         ret = bn_mul_mont_fixed_top(n, n, r, b->m_ctx, ctx);
193         bn_correct_top_consttime(n);
194     } else {
195         ret = BN_mod_mul(n, n, r, b->mod, ctx);
196     }
197 
198     bn_check_top(n);
199     return ret;
200 }
201 
BN_BLINDING_is_current_thread(BN_BLINDING * b)202 int BN_BLINDING_is_current_thread(BN_BLINDING *b)
203 {
204     return CRYPTO_THREAD_compare_id(CRYPTO_THREAD_get_current_id(), b->tid);
205 }
206 
BN_BLINDING_set_current_thread(BN_BLINDING * b)207 void BN_BLINDING_set_current_thread(BN_BLINDING *b)
208 {
209     b->tid = CRYPTO_THREAD_get_current_id();
210 }
211 
BN_BLINDING_lock(BN_BLINDING * b)212 int BN_BLINDING_lock(BN_BLINDING *b)
213 {
214     return CRYPTO_THREAD_write_lock(b->lock);
215 }
216 
BN_BLINDING_unlock(BN_BLINDING * b)217 int BN_BLINDING_unlock(BN_BLINDING *b)
218 {
219     return CRYPTO_THREAD_unlock(b->lock);
220 }
221 
BN_BLINDING_get_flags(const BN_BLINDING * b)222 unsigned long BN_BLINDING_get_flags(const BN_BLINDING *b)
223 {
224     return b->flags;
225 }
226 
BN_BLINDING_set_flags(BN_BLINDING * b,unsigned long flags)227 void BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags)
228 {
229     b->flags = flags;
230 }
231 
BN_BLINDING_create_param(BN_BLINDING * b,const BIGNUM * e,BIGNUM * m,BN_CTX * ctx,int (* bn_mod_exp)(BIGNUM * r,const BIGNUM * a,const BIGNUM * p,const BIGNUM * m,BN_CTX * ctx,BN_MONT_CTX * m_ctx),BN_MONT_CTX * m_ctx)232 BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
233                                       const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
234                                       int (*bn_mod_exp) (BIGNUM *r,
235                                                          const BIGNUM *a,
236                                                          const BIGNUM *p,
237                                                          const BIGNUM *m,
238                                                          BN_CTX *ctx,
239                                                          BN_MONT_CTX *m_ctx),
240                                       BN_MONT_CTX *m_ctx)
241 {
242     int retry_counter = 32;
243     BN_BLINDING *ret = NULL;
244 
245     if (b == NULL)
246         ret = BN_BLINDING_new(NULL, NULL, m);
247     else
248         ret = b;
249 
250     if (ret == NULL)
251         goto err;
252 
253     if (ret->A == NULL && (ret->A = BN_new()) == NULL)
254         goto err;
255     if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL)
256         goto err;
257 
258     if (e != NULL) {
259         BN_free(ret->e);
260         ret->e = BN_dup(e);
261     }
262     if (ret->e == NULL)
263         goto err;
264 
265     if (bn_mod_exp != NULL)
266         ret->bn_mod_exp = bn_mod_exp;
267     if (m_ctx != NULL)
268         ret->m_ctx = m_ctx;
269 
270     do {
271         int rv;
272         if (!BN_priv_rand_range_ex(ret->A, ret->mod, 0, ctx))
273             goto err;
274         if (int_bn_mod_inverse(ret->Ai, ret->A, ret->mod, ctx, &rv))
275             break;
276 
277         /*
278          * this should almost never happen for good RSA keys
279          */
280         if (!rv)
281             goto err;
282 
283         if (retry_counter-- == 0) {
284             ERR_raise(ERR_LIB_BN, BN_R_TOO_MANY_ITERATIONS);
285             goto err;
286         }
287     } while (1);
288 
289     if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) {
290         if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))
291             goto err;
292     } else {
293         if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx))
294             goto err;
295     }
296 
297     if (ret->m_ctx != NULL) {
298         if (!bn_to_mont_fixed_top(ret->Ai, ret->Ai, ret->m_ctx, ctx)
299             || !bn_to_mont_fixed_top(ret->A, ret->A, ret->m_ctx, ctx))
300             goto err;
301     }
302 
303     return ret;
304  err:
305     if (b == NULL) {
306         BN_BLINDING_free(ret);
307         ret = NULL;
308     }
309 
310     return ret;
311 }
312