File libgcrypt-CVE-2021-33560-ElGamal-exponent-blind... of Package libgcrypt

Overview Repositories Revisions Requests Users Attributes Meta

File libgcrypt-CVE-2021-33560-ElGamal-exponent-blinding.patch of Package libgcrypt (Revision a9706b1544bf227037f91de7334ed4ba)

Currently displaying revision a9706b1544bf227037f91de7334ed4ba , Show latest

From e8b7f10be275bcedb5fc05ed4837a89bfd605c61 Mon Sep 17 00:00:00 2001
From: NIIBE Yutaka <gniibe@fsij.org>
Date: Tue, 13 Apr 2021 10:00:00 +0900
Subject: [PATCH 179/200] cipher: Hardening ElGamal by introducing exponent
 blinding too.

* cipher/elgamal.c (do_encrypt): Also do exponent blinding.

Base blinding had been introduced with USE_BLINDING.  This patch add
exponent blinding as well to mitigate side-channel attack on mpi_powm.

GnuPG-bug-id: 5328
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
---
 cipher/elgamal.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/cipher/elgamal.c b/cipher/elgamal.c
index 4eb52d62..9835122f 100644
--- a/cipher/elgamal.c
+++ b/cipher/elgamal.c
@@ -522,8 +522,9 @@ do_encrypt(gcry_mpi_t a, gcry_mpi_t b, gcry_mpi_t input, ELG_public_key *pkey )
 static void
 decrypt (gcry_mpi_t output, gcry_mpi_t a, gcry_mpi_t b, ELG_secret_key *skey )
 {
-  gcry_mpi_t t1, t2, r;
+  gcry_mpi_t t1, t2, r, r1, h;
   unsigned int nbits = mpi_get_nbits (skey->p);
+  gcry_mpi_t x_blind;
 
   mpi_normalize (a);
   mpi_normalize (b);
@@ -534,20 +535,33 @@ decrypt (gcry_mpi_t output, gcry_mpi_t a, gcry_mpi_t b, ELG_secret_key *skey )
 
   t2 = mpi_snew (nbits);
   r  = mpi_new (nbits);
+  r1 = mpi_new (nbits);
+  h  = mpi_new (nbits);
+  x_blind = mpi_snew (nbits);
 
   /* We need a random number of about the prime size.  The random
      number merely needs to be unpredictable; thus we use level 0.  */
   _gcry_mpi_randomize (r, nbits, GCRY_WEAK_RANDOM);
 
+  /* Also, exponent blinding: x_blind = x + (p-1)*r1 */
+  _gcry_mpi_randomize (r1, nbits, GCRY_WEAK_RANDOM);
+  mpi_set_highbit (r1, nbits - 1);
+  mpi_sub_ui (h, skey->p, 1);
+  mpi_mul (x_blind, h, r1);
+  mpi_add (x_blind, skey->x, x_blind);
+
   /* t1 = r^x mod p */
-  mpi_powm (t1, r, skey->x, skey->p);
+  mpi_powm (t1, r, x_blind, skey->p);
   /* t2 = (a * r)^-x mod p */
   mpi_mulm (t2, a, r, skey->p);
-  mpi_powm (t2, t2, skey->x, skey->p);
+  mpi_powm (t2, t2, x_blind, skey->p);
   mpi_invm (t2, t2, skey->p);
   /* t1 = (t1 * t2) mod p*/
   mpi_mulm (t1, t1, t2, skey->p);
 
+  mpi_free (x_blind);
+  mpi_free (h);
+  mpi_free (r1);
   mpi_free (r);
   mpi_free (t2);
 
-- 
2.31.1

Places

File libgcrypt-CVE-2021-33560-ElGamal-exponent-blinding.patch of Package libgcrypt (Revision a9706b1544bf227037f91de7334ed4ba)

Places