1 From fbd10abc057453789017f11c7f1fc8e6c61b79a3 Mon Sep 17 00:00:00 2001
2 From: NIIBE Yutaka <gniibe@fsij.org>
3 Date: Tue, 4 Apr 2017 17:38:05 +0900
4 Subject: [PATCH] mpi: Simplify mpi_powm.
6 * mpi/mpi-pow.c (_gcry_mpi_powm): Simplify the loop.
10 This fix is not a solution for the problem reported (yet). The
11 problem is that the current algorithm of _gcry_mpi_powm depends on
12 exponent and some information leaks is possible.
14 Reported-by: Andreas Zankl <andreas.zankl@aisec.fraunhofer.de>
15 Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
17 (backport from master commit:
18 719468e53133d3bdf12156c5bfdea2bf15f9f6f1)
20 mpi/mpi-pow.c | 105 +++++++++++++++++-----------------------------------------
21 1 file changed, 30 insertions(+), 75 deletions(-)
23 Index: libgcrypt20-1.6.5/mpi/mpi-pow.c
24 ===================================================================
25 --- libgcrypt20-1.6.5.orig/mpi/mpi-pow.c 2017-07-03 08:16:07.341489918 -0400
26 +++ libgcrypt20-1.6.5/mpi/mpi-pow.c 2017-07-03 08:16:07.341489918 -0400
27 @@ -613,12 +613,8 @@ _gcry_mpi_powm (gcry_mpi_t res,
41 c = BITS_PER_MPI_LIMB;
42 @@ -633,38 +629,33 @@ _gcry_mpi_powm (gcry_mpi_t res,
46 + e0 = (e >> (BITS_PER_MPI_LIMB - W));
49 - e0 = (e >> (BITS_PER_MPI_LIMB - W));
60 - e = (e >> (BITS_PER_MPI_LIMB - c));
62 + e0 = (e >> (BITS_PER_MPI_LIMB - c));
70 + c = BITS_PER_MPI_LIMB;
71 + e0 |= (e >> (BITS_PER_MPI_LIMB - (W - c0)));
75 - e0 = (e >> (BITS_PER_MPI_LIMB - W))
76 - | (ep[i] >> (BITS_PER_MPI_LIMB - W + c0));
77 - e = (ep[i] << (W - c0));
78 - c = BITS_PER_MPI_LIMB - W + c0;
85 count_trailing_zeros (c0, e0);
88 - for (j += W - c0; j; j--)
90 - mul_mod (xp, &xsize, rp, rsize, rp, rsize, mp, msize, &karactx);
91 - tp = rp; rp = xp; xp = tp;
96 * base_u <= precomp[e0]
97 * base_u_size <= precomp_size[e0]
98 @@ -681,25 +672,23 @@ _gcry_mpi_powm (gcry_mpi_t res,
101 mpi_set_cond (&w, &u, k == e0);
102 - base_u_size |= (precomp_size[k] & ((mpi_size_t)0 - (k == e0)) );
103 + base_u_size |= ( precomp_size[k] & ((mpi_size_t)0 - (k == e0)) );
106 - mul_mod (xp, &xsize, rp, rsize, base_u, base_u_size,
107 - mp, msize, &karactx);
108 - tp = rp; rp = xp; xp = tp;
110 + for (j += W - c0; j >= 0; j--)
112 + mul_mod (xp, &xsize, rp, rsize,
113 + j == 0 ? base_u : rp, j == 0 ? base_u_size : rsize,
114 + mp, msize, &karactx);
115 + tp = rp; rp = xp; xp = tp;
127 - count_trailing_zeros (c, e);
134 mul_mod (xp, &xsize, rp, rsize, rp, rsize, mp, msize, &karactx);
135 @@ -707,40 +696,6 @@ _gcry_mpi_powm (gcry_mpi_t res,
142 - * base_u <= precomp[(e>>1)]
143 - * base_u_size <= precomp_size[(e>>1)]
146 - for (k = 0; k < (1<< (W - 1)); k++)
148 - struct gcry_mpi w, u;
149 - w.alloced = w.nlimbs = precomp_size[k];
150 - u.alloced = u.nlimbs = precomp_size[k];
151 - w.sign = u.sign = 0;
152 - w.flags = u.flags = 0;
156 - mpi_set_cond (&w, &u, k == (e>>1));
157 - base_u_size |= (precomp_size[k] & ((mpi_size_t)0 - (k == (e>>1))) );
160 - mul_mod (xp, &xsize, rp, rsize, base_u, base_u_size,
161 - mp, msize, &karactx);
162 - tp = rp; rp = xp; xp = tp;
167 - mul_mod (xp, &xsize, rp, rsize, rp, rsize, mp, msize, &karactx);
168 - tp = rp; rp = xp; xp = tp;
173 /* We shifted MOD, the modulo reduction argument, left
174 MOD_SHIFT_CNT steps. Adjust the result by reducing it with the