155714Skris/* crypto/bn/bn_blind.c */ 2160814Ssimon/* ==================================================================== 3238405Sjkim * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. 4160814Ssimon * 5160814Ssimon * Redistribution and use in source and binary forms, with or without 6160814Ssimon * modification, are permitted provided that the following conditions 7160814Ssimon * are met: 8160814Ssimon * 9160814Ssimon * 1. Redistributions of source code must retain the above copyright 10160814Ssimon * notice, this list of conditions and the following disclaimer. 11160814Ssimon * 12160814Ssimon * 2. Redistributions in binary form must reproduce the above copyright 13160814Ssimon * notice, this list of conditions and the following disclaimer in 14160814Ssimon * the documentation and/or other materials provided with the 15160814Ssimon * distribution. 16160814Ssimon * 17160814Ssimon * 3. All advertising materials mentioning features or use of this 18160814Ssimon * software must display the following acknowledgment: 19160814Ssimon * "This product includes software developed by the OpenSSL Project 20160814Ssimon * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 21160814Ssimon * 22160814Ssimon * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 23160814Ssimon * endorse or promote products derived from this software without 24160814Ssimon * prior written permission. For written permission, please contact 25160814Ssimon * openssl-core@openssl.org. 26160814Ssimon * 27160814Ssimon * 5. Products derived from this software may not be called "OpenSSL" 28160814Ssimon * nor may "OpenSSL" appear in their names without prior written 29160814Ssimon * permission of the OpenSSL Project. 30160814Ssimon * 31160814Ssimon * 6. Redistributions of any form whatsoever must retain the following 32160814Ssimon * acknowledgment: 33160814Ssimon * "This product includes software developed by the OpenSSL Project 34160814Ssimon * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 35160814Ssimon * 36160814Ssimon * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 37160814Ssimon * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 38160814Ssimon * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 39160814Ssimon * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 40160814Ssimon * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 41160814Ssimon * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 42160814Ssimon * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 43160814Ssimon * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 44160814Ssimon * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 45160814Ssimon * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 46160814Ssimon * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 47160814Ssimon * OF THE POSSIBILITY OF SUCH DAMAGE. 48160814Ssimon * ==================================================================== 49160814Ssimon * 50160814Ssimon * This product includes cryptographic software written by Eric Young 51160814Ssimon * (eay@cryptsoft.com). This product includes software written by Tim 52160814Ssimon * Hudson (tjh@cryptsoft.com). 53160814Ssimon * 54160814Ssimon */ 5555714Skris/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 5655714Skris * All rights reserved. 5755714Skris * 5855714Skris * This package is an SSL implementation written 5955714Skris * by Eric Young (eay@cryptsoft.com). 6055714Skris * The implementation was written so as to conform with Netscapes SSL. 6155714Skris * 6255714Skris * This library is free for commercial and non-commercial use as long as 6355714Skris * the following conditions are aheared to. The following conditions 6455714Skris * apply to all code found in this distribution, be it the RC4, RSA, 6555714Skris * lhash, DES, etc., code; not just the SSL code. The SSL documentation 6655714Skris * included with this distribution is covered by the same copyright terms 6755714Skris * except that the holder is Tim Hudson (tjh@cryptsoft.com). 6855714Skris * 6955714Skris * Copyright remains Eric Young's, and as such any Copyright notices in 7055714Skris * the code are not to be removed. 7155714Skris * If this package is used in a product, Eric Young should be given attribution 7255714Skris * as the author of the parts of the library used. 7355714Skris * This can be in the form of a textual message at program startup or 7455714Skris * in documentation (online or textual) provided with the package. 7555714Skris * 7655714Skris * Redistribution and use in source and binary forms, with or without 7755714Skris * modification, are permitted provided that the following conditions 7855714Skris * are met: 7955714Skris * 1. Redistributions of source code must retain the copyright 8055714Skris * notice, this list of conditions and the following disclaimer. 8155714Skris * 2. Redistributions in binary form must reproduce the above copyright 8255714Skris * notice, this list of conditions and the following disclaimer in the 8355714Skris * documentation and/or other materials provided with the distribution. 8455714Skris * 3. All advertising materials mentioning features or use of this software 8555714Skris * must display the following acknowledgement: 8655714Skris * "This product includes cryptographic software written by 8755714Skris * Eric Young (eay@cryptsoft.com)" 8855714Skris * The word 'cryptographic' can be left out if the rouines from the library 8955714Skris * being used are not cryptographic related :-). 9055714Skris * 4. If you include any Windows specific code (or a derivative thereof) from 9155714Skris * the apps directory (application code) you must include an acknowledgement: 9255714Skris * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 9355714Skris * 9455714Skris * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 9555714Skris * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 9655714Skris * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 9755714Skris * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 9855714Skris * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 9955714Skris * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 10055714Skris * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 10155714Skris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 10255714Skris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 10355714Skris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 10455714Skris * SUCH DAMAGE. 10555714Skris * 10655714Skris * The licence and distribution terms for any publically available version or 10755714Skris * derivative of this code cannot be changed. i.e. this code cannot simply be 10855714Skris * copied and put under another distribution licence 10955714Skris * [including the GNU Public Licence.] 11055714Skris */ 11155714Skris 11255714Skris#include <stdio.h> 11355714Skris#include "cryptlib.h" 11455714Skris#include "bn_lcl.h" 11555714Skris 116160814Ssimon#define BN_BLINDING_COUNTER 32 117160814Ssimon 118160814Ssimonstruct bn_blinding_st 11955714Skris { 120160814Ssimon BIGNUM *A; 121160814Ssimon BIGNUM *Ai; 122160814Ssimon BIGNUM *e; 123160814Ssimon BIGNUM *mod; /* just a reference */ 124238405Sjkim#ifndef OPENSSL_NO_DEPRECATED 125160814Ssimon unsigned long thread_id; /* added in OpenSSL 0.9.6j and 0.9.7b; 126160814Ssimon * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */ 127238405Sjkim#endif 128238405Sjkim CRYPTO_THREADID tid; 129237657Sjkim int counter; 130160814Ssimon unsigned long flags; 131160814Ssimon BN_MONT_CTX *m_ctx; 132160814Ssimon int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, 133160814Ssimon const BIGNUM *m, BN_CTX *ctx, 134160814Ssimon BN_MONT_CTX *m_ctx); 135160814Ssimon }; 136160814Ssimon 137238405SjkimBN_BLINDING *BN_BLINDING_new(const BIGNUM *A, const BIGNUM *Ai, BIGNUM *mod) 138160814Ssimon { 13955714Skris BN_BLINDING *ret=NULL; 14055714Skris 14155714Skris bn_check_top(mod); 14255714Skris 14368651Skris if ((ret=(BN_BLINDING *)OPENSSL_malloc(sizeof(BN_BLINDING))) == NULL) 14455714Skris { 14555714Skris BNerr(BN_F_BN_BLINDING_NEW,ERR_R_MALLOC_FAILURE); 14655714Skris return(NULL); 14755714Skris } 14855714Skris memset(ret,0,sizeof(BN_BLINDING)); 149160814Ssimon if (A != NULL) 150160814Ssimon { 151160814Ssimon if ((ret->A = BN_dup(A)) == NULL) goto err; 152160814Ssimon } 153160814Ssimon if (Ai != NULL) 154160814Ssimon { 155160814Ssimon if ((ret->Ai = BN_dup(Ai)) == NULL) goto err; 156160814Ssimon } 157194206Ssimon 158194206Ssimon /* save a copy of mod in the BN_BLINDING structure */ 159194206Ssimon if ((ret->mod = BN_dup(mod)) == NULL) goto err; 160194206Ssimon if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0) 161194206Ssimon BN_set_flags(ret->mod, BN_FLG_CONSTTIME); 162194206Ssimon 163237657Sjkim /* Set the counter to the special value -1 164237657Sjkim * to indicate that this is never-used fresh blinding 165237657Sjkim * that does not need updating before first use. */ 166237657Sjkim ret->counter = -1; 167238405Sjkim CRYPTO_THREADID_current(&ret->tid); 16855714Skris return(ret); 16955714Skriserr: 17055714Skris if (ret != NULL) BN_BLINDING_free(ret); 17155714Skris return(NULL); 17255714Skris } 17355714Skris 17455714Skrisvoid BN_BLINDING_free(BN_BLINDING *r) 17555714Skris { 17655714Skris if(r == NULL) 17755714Skris return; 17855714Skris 17955714Skris if (r->A != NULL) BN_free(r->A ); 18055714Skris if (r->Ai != NULL) BN_free(r->Ai); 181160814Ssimon if (r->e != NULL) BN_free(r->e ); 182194206Ssimon if (r->mod != NULL) BN_free(r->mod); 18368651Skris OPENSSL_free(r); 18455714Skris } 18555714Skris 18655714Skrisint BN_BLINDING_update(BN_BLINDING *b, BN_CTX *ctx) 18755714Skris { 18855714Skris int ret=0; 18955714Skris 19055714Skris if ((b->A == NULL) || (b->Ai == NULL)) 19155714Skris { 19255714Skris BNerr(BN_F_BN_BLINDING_UPDATE,BN_R_NOT_INITIALIZED); 19355714Skris goto err; 19455714Skris } 19555714Skris 196237657Sjkim if (b->counter == -1) 197237657Sjkim b->counter = 0; 198237657Sjkim 199237657Sjkim if (++b->counter == BN_BLINDING_COUNTER && b->e != NULL && 200160814Ssimon !(b->flags & BN_BLINDING_NO_RECREATE)) 201160814Ssimon { 202160814Ssimon /* re-create blinding parameters */ 203160814Ssimon if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL)) 204160814Ssimon goto err; 205160814Ssimon } 206160814Ssimon else if (!(b->flags & BN_BLINDING_NO_UPDATE)) 207160814Ssimon { 208160814Ssimon if (!BN_mod_mul(b->A,b->A,b->A,b->mod,ctx)) goto err; 209160814Ssimon if (!BN_mod_mul(b->Ai,b->Ai,b->Ai,b->mod,ctx)) goto err; 210160814Ssimon } 211160814Ssimon 21255714Skris ret=1; 21355714Skriserr: 214237657Sjkim if (b->counter == BN_BLINDING_COUNTER) 215237657Sjkim b->counter = 0; 21655714Skris return(ret); 21755714Skris } 21855714Skris 21955714Skrisint BN_BLINDING_convert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) 22055714Skris { 221160814Ssimon return BN_BLINDING_convert_ex(n, NULL, b, ctx); 222160814Ssimon } 223160814Ssimon 224160814Ssimonint BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx) 225160814Ssimon { 226160814Ssimon int ret = 1; 227160814Ssimon 22855714Skris bn_check_top(n); 22955714Skris 23055714Skris if ((b->A == NULL) || (b->Ai == NULL)) 23155714Skris { 232160814Ssimon BNerr(BN_F_BN_BLINDING_CONVERT_EX,BN_R_NOT_INITIALIZED); 23355714Skris return(0); 23455714Skris } 235160814Ssimon 236237657Sjkim if (b->counter == -1) 237237657Sjkim /* Fresh blinding, doesn't need updating. */ 238237657Sjkim b->counter = 0; 239237657Sjkim else if (!BN_BLINDING_update(b,ctx)) 240237657Sjkim return(0); 241237657Sjkim 242160814Ssimon if (r != NULL) 243160814Ssimon { 244160814Ssimon if (!BN_copy(r, b->Ai)) ret=0; 245160814Ssimon } 246160814Ssimon 247160814Ssimon if (!BN_mod_mul(n,n,b->A,b->mod,ctx)) ret=0; 248160814Ssimon 249160814Ssimon return ret; 25055714Skris } 25155714Skris 25255714Skrisint BN_BLINDING_invert(BIGNUM *n, BN_BLINDING *b, BN_CTX *ctx) 25355714Skris { 254160814Ssimon return BN_BLINDING_invert_ex(n, NULL, b, ctx); 255160814Ssimon } 256160814Ssimon 257160814Ssimonint BN_BLINDING_invert_ex(BIGNUM *n, const BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx) 258160814Ssimon { 25955714Skris int ret; 26055714Skris 26155714Skris bn_check_top(n); 262160814Ssimon 263160814Ssimon if (r != NULL) 264160814Ssimon ret = BN_mod_mul(n, n, r, b->mod, ctx); 265160814Ssimon else 26655714Skris { 267237657Sjkim if (b->Ai == NULL) 268237657Sjkim { 269237657Sjkim BNerr(BN_F_BN_BLINDING_INVERT_EX,BN_R_NOT_INITIALIZED); 27055714Skris return(0); 271237657Sjkim } 272237657Sjkim ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx); 27355714Skris } 274237657Sjkim 275160814Ssimon bn_check_top(n); 27655714Skris return(ret); 27755714Skris } 27855714Skris 279238405Sjkim#ifndef OPENSSL_NO_DEPRECATED 280160814Ssimonunsigned long BN_BLINDING_get_thread_id(const BN_BLINDING *b) 281160814Ssimon { 282160814Ssimon return b->thread_id; 283160814Ssimon } 284160814Ssimon 285160814Ssimonvoid BN_BLINDING_set_thread_id(BN_BLINDING *b, unsigned long n) 286160814Ssimon { 287160814Ssimon b->thread_id = n; 288160814Ssimon } 289238405Sjkim#endif 290160814Ssimon 291238405SjkimCRYPTO_THREADID *BN_BLINDING_thread_id(BN_BLINDING *b) 292238405Sjkim { 293238405Sjkim return &b->tid; 294238405Sjkim } 295238405Sjkim 296160814Ssimonunsigned long BN_BLINDING_get_flags(const BN_BLINDING *b) 297160814Ssimon { 298160814Ssimon return b->flags; 299160814Ssimon } 300160814Ssimon 301160814Ssimonvoid BN_BLINDING_set_flags(BN_BLINDING *b, unsigned long flags) 302160814Ssimon { 303160814Ssimon b->flags = flags; 304160814Ssimon } 305160814Ssimon 306160814SsimonBN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b, 307238405Sjkim const BIGNUM *e, BIGNUM *m, BN_CTX *ctx, 308160814Ssimon int (*bn_mod_exp)(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, 309160814Ssimon const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx), 310160814Ssimon BN_MONT_CTX *m_ctx) 311160814Ssimon{ 312160814Ssimon int retry_counter = 32; 313160814Ssimon BN_BLINDING *ret = NULL; 314160814Ssimon 315160814Ssimon if (b == NULL) 316160814Ssimon ret = BN_BLINDING_new(NULL, NULL, m); 317160814Ssimon else 318160814Ssimon ret = b; 319160814Ssimon 320160814Ssimon if (ret == NULL) 321160814Ssimon goto err; 322160814Ssimon 323160814Ssimon if (ret->A == NULL && (ret->A = BN_new()) == NULL) 324160814Ssimon goto err; 325160814Ssimon if (ret->Ai == NULL && (ret->Ai = BN_new()) == NULL) 326160814Ssimon goto err; 327160814Ssimon 328160814Ssimon if (e != NULL) 329160814Ssimon { 330160814Ssimon if (ret->e != NULL) 331160814Ssimon BN_free(ret->e); 332160814Ssimon ret->e = BN_dup(e); 333160814Ssimon } 334160814Ssimon if (ret->e == NULL) 335160814Ssimon goto err; 336160814Ssimon 337160814Ssimon if (bn_mod_exp != NULL) 338160814Ssimon ret->bn_mod_exp = bn_mod_exp; 339160814Ssimon if (m_ctx != NULL) 340160814Ssimon ret->m_ctx = m_ctx; 341160814Ssimon 342160814Ssimon do { 343160814Ssimon if (!BN_rand_range(ret->A, ret->mod)) goto err; 344160814Ssimon if (BN_mod_inverse(ret->Ai, ret->A, ret->mod, ctx) == NULL) 345160814Ssimon { 346160814Ssimon /* this should almost never happen for good RSA keys */ 347160814Ssimon unsigned long error = ERR_peek_last_error(); 348160814Ssimon if (ERR_GET_REASON(error) == BN_R_NO_INVERSE) 349160814Ssimon { 350160814Ssimon if (retry_counter-- == 0) 351160814Ssimon { 352160814Ssimon BNerr(BN_F_BN_BLINDING_CREATE_PARAM, 353160814Ssimon BN_R_TOO_MANY_ITERATIONS); 354160814Ssimon goto err; 355160814Ssimon } 356160814Ssimon ERR_clear_error(); 357160814Ssimon } 358160814Ssimon else 359160814Ssimon goto err; 360160814Ssimon } 361160814Ssimon else 362160814Ssimon break; 363160814Ssimon } while (1); 364160814Ssimon 365160814Ssimon if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) 366160814Ssimon { 367160814Ssimon if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx)) 368160814Ssimon goto err; 369160814Ssimon } 370160814Ssimon else 371160814Ssimon { 372160814Ssimon if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx)) 373160814Ssimon goto err; 374160814Ssimon } 375160814Ssimon 376160814Ssimon return ret; 377160814Ssimonerr: 378160814Ssimon if (b == NULL && ret != NULL) 379160814Ssimon { 380160814Ssimon BN_BLINDING_free(ret); 381160814Ssimon ret = NULL; 382160814Ssimon } 383160814Ssimon 384160814Ssimon return ret; 385160814Ssimon} 386