aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/openssl/crypto/rsa/rsa_eay.c
diff options
context:
space:
mode:
authorJacques Vidrine <nectar@FreeBSD.org>2003-10-03 01:32:14 +0000
committerJacques Vidrine <nectar@FreeBSD.org>2003-10-03 01:32:14 +0000
commit76caa953f91843752af72f44c4367221d831c09c (patch)
treecff016a6835014c6f9c4ac973e362d4aefc18934 /crypto/openssl/crypto/rsa/rsa_eay.c
parent262a50de712ecd95d75f656136832a33650adc49 (diff)
downloadsrc-76caa953f91843752af72f44c4367221d831c09c.tar.gz
src-76caa953f91843752af72f44c4367221d831c09c.zip
MFC OpenSSL 0.9.7c.
Approved by: re
Notes
Notes: svn path=/stable/4/; revision=120682
Diffstat (limited to 'crypto/openssl/crypto/rsa/rsa_eay.c')
-rw-r--r--crypto/openssl/crypto/rsa/rsa_eay.c128
1 files changed, 113 insertions, 15 deletions
diff --git a/crypto/openssl/crypto/rsa/rsa_eay.c b/crypto/openssl/crypto/rsa/rsa_eay.c
index e4bcf499d064..5f7a1f20a359 100644
--- a/crypto/openssl/crypto/rsa/rsa_eay.c
+++ b/crypto/openssl/crypto/rsa/rsa_eay.c
@@ -55,15 +55,13 @@
* copied and put under another distribution licence
* [including the GNU Public Licence.]
*/
+/* $FreeBSD$ */
#include <stdio.h>
#include "cryptlib.h"
#include <openssl/bn.h>
#include <openssl/rsa.h>
#include <openssl/rand.h>
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
#ifndef RSA_NULL
@@ -208,12 +206,46 @@ static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx)
#define BLINDING_HELPER(rsa, ctx, err_instr) \
do { \
- if(((rsa)->flags & RSA_FLAG_BLINDING) && \
- ((rsa)->blinding == NULL) && \
- !rsa_eay_blinding(rsa, ctx)) \
- err_instr \
+ if((!((rsa)->flags & RSA_FLAG_NO_BLINDING)) && \
+ ((rsa)->blinding == NULL) && \
+ !rsa_eay_blinding(rsa, ctx)) \
+ err_instr \
} while(0)
+static BN_BLINDING *setup_blinding(RSA *rsa, BN_CTX *ctx)
+ {
+ BIGNUM *A, *Ai;
+ BN_BLINDING *ret = NULL;
+
+ /* added in OpenSSL 0.9.6j and 0.9.7b */
+
+ /* NB: similar code appears in RSA_blinding_on (rsa_lib.c);
+ * this should be placed in a new function of its own, but for reasons
+ * of binary compatibility can't */
+
+ BN_CTX_start(ctx);
+ A = BN_CTX_get(ctx);
+ if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL)
+ {
+ /* if PRNG is not properly seeded, resort to secret exponent as unpredictable seed */
+ RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0);
+ if (!BN_pseudo_rand_range(A,rsa->n)) goto err;
+ }
+ else
+ {
+ if (!BN_rand_range(A,rsa->n)) goto err;
+ }
+ if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err;
+
+ if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n))
+ goto err;
+ ret = BN_BLINDING_new(A,Ai,rsa->n);
+ BN_free(Ai);
+err:
+ BN_CTX_end(ctx);
+ return ret;
+ }
+
/* signing */
static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa, int padding)
@@ -222,6 +254,8 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
int i,j,k,num=0,r= -1;
unsigned char *buf=NULL;
BN_CTX *ctx=NULL;
+ int local_blinding = 0;
+ BN_BLINDING *blinding = NULL;
BN_init(&f);
BN_init(&ret);
@@ -259,9 +293,38 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
}
BLINDING_HELPER(rsa, ctx, goto err;);
+ blinding = rsa->blinding;
+
+ /* Now unless blinding is disabled, 'blinding' is non-NULL.
+ * But the BN_BLINDING object may be owned by some other thread
+ * (we don't want to keep it constant and we don't want to use
+ * lots of locking to avoid race conditions, so only a single
+ * thread can use it; other threads have to use local blinding
+ * factors) */
+ if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
+ {
+ if (blinding == NULL)
+ {
+ RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR);
+ goto err;
+ }
+ }
+
+ if (blinding != NULL)
+ {
+ if (blinding->thread_id != CRYPTO_thread_id())
+ {
+ /* we need a local one-time blinding factor */
- if (rsa->flags & RSA_FLAG_BLINDING)
- if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err;
+ blinding = setup_blinding(rsa, ctx);
+ if (blinding == NULL)
+ goto err;
+ local_blinding = 1;
+ }
+ }
+
+ if (blinding)
+ if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err;
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
((rsa->p != NULL) &&
@@ -275,8 +338,8 @@ static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err;
}
- if (rsa->flags & RSA_FLAG_BLINDING)
- if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err;
+ if (blinding)
+ if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
/* put in leading 0 bytes if the number is less than the
* length of the modulus */
@@ -290,6 +353,8 @@ err:
if (ctx != NULL) BN_CTX_free(ctx);
BN_clear_free(&ret);
BN_clear_free(&f);
+ if (local_blinding)
+ BN_BLINDING_free(blinding);
if (buf != NULL)
{
OPENSSL_cleanse(buf,num);
@@ -306,6 +371,8 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
unsigned char *p;
unsigned char *buf=NULL;
BN_CTX *ctx=NULL;
+ int local_blinding = 0;
+ BN_BLINDING *blinding = NULL;
BN_init(&f);
BN_init(&ret);
@@ -338,9 +405,38 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
}
BLINDING_HELPER(rsa, ctx, goto err;);
+ blinding = rsa->blinding;
+
+ /* Now unless blinding is disabled, 'blinding' is non-NULL.
+ * But the BN_BLINDING object may be owned by some other thread
+ * (we don't want to keep it constant and we don't want to use
+ * lots of locking to avoid race conditions, so only a single
+ * thread can use it; other threads have to use local blinding
+ * factors) */
+ if (!(rsa->flags & RSA_FLAG_NO_BLINDING))
+ {
+ if (blinding == NULL)
+ {
+ RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);
+ goto err;
+ }
+ }
+
+ if (blinding != NULL)
+ {
+ if (blinding->thread_id != CRYPTO_thread_id())
+ {
+ /* we need a local one-time blinding factor */
+
+ blinding = setup_blinding(rsa, ctx);
+ if (blinding == NULL)
+ goto err;
+ local_blinding = 1;
+ }
+ }
- if (rsa->flags & RSA_FLAG_BLINDING)
- if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err;
+ if (blinding)
+ if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err;
/* do the decrypt */
if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
@@ -356,8 +452,8 @@ static int RSA_eay_private_decrypt(int flen, const unsigned char *from,
goto err;
}
- if (rsa->flags & RSA_FLAG_BLINDING)
- if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err;
+ if (blinding)
+ if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err;
p=buf;
j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */
@@ -389,6 +485,8 @@ err:
if (ctx != NULL) BN_CTX_free(ctx);
BN_clear_free(&f);
BN_clear_free(&ret);
+ if (local_blinding)
+ BN_BLINDING_free(blinding);
if (buf != NULL)
{
OPENSSL_cleanse(buf,num);