j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed carry propagation bug in P-256 'm62' implementation (found by Auke Zeilstra; consequences unclear, possibly some invalid curve attacks in static ECDH contexts).

Browse source
This commit is contained in:
Thomas Pornin 2019-12-14 16:53:30 +01:00
parent 15b3af72f3
commit 252dba9149
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/ec/ec_p256_m62.c
View file

@ -580,7 +580,7 @@ f256_final_reduce(uint64_t *a)
w = t[2] - cc; w = t[2] - cc;
t[2] = w & MASK52; t[2] = w & MASK52;
cc = w >> 63; cc = w >> 63;
w = t[3] - BIT(36); w = t[3] - BIT(36) - cc;
t[3] = w & MASK52; t[3] = w & MASK52;
cc = w >> 63; cc = w >> 63;
t[4] -= cc; t[4] -= cc;