From f21b9f7b21067fa3630607cdc1663141b2735ae5 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Thu, 2 Mar 2017 12:24:31 +0000 Subject: [PATCH] Create meta-gplv2 from files from OE-Core Upstream-Status: Backport https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d CVE: CVE-2015-8803 CVE: CVE-2015-8805 Same fix for both. Signed-off-by: Armin Kuster --- ChangeLog | 6 ++++++ ecc-256.c | 23 ++++++++++++++++++----- 2 files changed, 24 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 7b7854d..abdd974 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2015-12-10 Niels Möller + + * ecc-256.c (ecc_256_modp): Fixed carry propagation bug. Problem + reported by Hanno Böck. + (ecc_256_modq): Fixed another carry propagation bug. + 2013-05-28 Niels Möller * Released nettle-2.7.1. diff --git a/ecc-256.c b/ecc-256.c index 571cf73..7bee4c7 100644 --- a/ecc-256.c +++ b/ecc-256.c @@ -96,9 +96,19 @@ ecc_256_modp (const struct ecc_curve *ecc, mp_limb_t *rp) q2 += t + (q1 < t); assert (q2 < 2); - - /* We multiply by two low limbs of p, 2^96 - 1, so we could use - shifts rather than mul. */ + /* + n-1 n-2 n-3 n-4 + +---+---+---+---+ + | u1| u0| u low | + +---+---+---+---+ + - | q1(2^96-1)| + +-------+---+ + |q2(2^.)| + +-------+ + + We multiply by two low limbs of p, 2^96 - 1, so we could use + shifts rather than mul. + */ t = mpn_submul_1 (rp + n - 4, ecc->p, 2, q1); t += cnd_sub_n (q2, rp + n - 3, ecc->p, 1); t += (-q2) & 0xffffffff; @@ -108,7 +118,10 @@ ecc_256_modp (const struct ecc_curve *ecc, mp_limb_t *rp) u0 -= t; t = (u1 < cy); u1 -= cy; - u1 += cnd_add_n (t, rp + n - 4, ecc->p, 3); + + cy = cnd_add_n (t, rp + n - 4, ecc->p, 2); + u0 += cy; + u1 += (u0 < cy); u1 -= (-t) & 0xffffffff; } rp[2] = u0; @@ -195,7 +208,7 @@ ecc_256_modq (const struct ecc_curve *ecc, mp_limb_t *rp) /* Conditional add of p */ u1 += t; - u2 += (t<<32) + (u0 < t); + u2 += (t<<32) + (u1 < t); t = cnd_add_n (t, rp + n - 4, ecc->q, 2); u1 += t;