bn/bn_lib.c: make BN_bn2binpad computationally constant-time.
authorAndy Polyakov <appro@openssl.org>
Sun, 4 Feb 2018 14:20:29 +0000 (15:20 +0100)
committerAndy Polyakov <appro@openssl.org>
Sat, 14 Jul 2018 11:40:25 +0000 (13:40 +0200)
commit75a67a036a041d9fdac0fd7fd5a461f48709a3d3
tree0134049689fc11cc5d4e0507db53cfe01cdb2d4d
parentdb9926ff007ad8cd999a4e7eff35b04505b744b8
bn/bn_lib.c: make BN_bn2binpad computationally constant-time.

"Computationally constant-time" means that it might still leak
information about input's length, but only in cases when input
is missing complete BN_ULONG limbs. But even then leak is possible
only if attacker can observe memory access pattern with limb
granularity.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5254)

(cherry picked from commit 89d8aade5f4011ddeea7827f08ec544c914f275a)
crypto/bn/bn_lib.c