j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed bug in bit length computation (implied some wrong RSA signatures in case of carry propagation with some specific key/factor lengths).

Browse source
This commit is contained in:
Thomas Pornin 2018-05-02 17:32:35 +02:00
parent 7d313ccce7
commit c1e540575c
3 changed files with 60 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/int/i15_mulacc.c
View file

@ -29,10 +29,19 @@ void
br_i15_mulacc(uint16_t *d, const uint16_t *a, const uint16_t *b)
{
size_t alen, blen, u;
unsigned dl, dh;
alen = (a[0] + 15) >> 4;
blen = (b[0] + 15) >> 4;
d[0] = a[0] + b[0];
/*
* Announced bit length of d[] will be the sum of the announced
* bit lengths of a[] and b[]; but the lengths are encoded.
*/
dl = (a[0] & 15) + (d[0] & 15);
dh = (a[0] >> 4) + (b[0] >> 4);
d[0] = (dh << 4) + dl + (~(uint16_t)(dl - 15) >> 15);
for (u = 0; u < blen; u ++) {
uint32_t f;
size_t v;

11
src/int/i31_mulacc.c
View file

@ -29,10 +29,19 @@ void
br_i31_mulacc(uint32_t *d, const uint32_t *a, const uint32_t *b)
{
size_t alen, blen, u;
uint32_t dl, dh;
alen = (a[0] + 31) >> 5;
blen = (b[0] + 31) >> 5;
d[0] = a[0] + b[0];
/*
* We want to add the two bit lengths, but these are encoded,
* which requires some extra care.
*/
dl = (a[0] & 31) + (b[0] & 31);
dh = (a[0] >> 5) + (b[0] >> 5);
d[0] = (dh << 5) + dl + (~(uint32_t)(dl - 31) >> 31);
for (u = 0; u < blen; u ++) {
uint32_t f;
size_t v;