Don't set the two top bits to one when generating a random number < q.:wq

diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c
index 5aef2d5fcffb6541a62f279c88d7ba1a2b43aab6..af3c56d770ecb2480b996875df3b5624dd205f26 100644 (file)
--- a/crypto/dsa/dsa_key.c
+++ b/crypto/dsa/dsa_key.c
@@ -84,7 +84,7 @@ int DSA_generate_key(DSA *dsa)
        i=BN_num_bits(dsa->q);
        for (;;)
                {
-               if (!BN_rand(priv_key,i,1,0))
+               if (!BN_rand(priv_key,i,0,0))
                        goto err;
                if (BN_cmp(priv_key,dsa->q) >= 0)
                        BN_sub(priv_key,priv_key,dsa->q);

diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
index b51cf6ad8d45dca2cfafb5510873f379e4851640..094356518f2e74419fbeed3a741f79c473625dd3 100644 (file)
--- a/crypto/dsa/dsa_ossl.c
+++ b/crypto/dsa/dsa_ossl.c
@@ -181,7 +181,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
        /* Get random k */
        for (;;)
                {
-               if (!BN_rand(&k, BN_num_bits(dsa->q), 1, 0)) goto err;
+               if (!BN_rand(&k, BN_num_bits(dsa->q), 0, 0)) goto err;
                if (BN_cmp(&k,dsa->q) >= 0)
                        BN_sub(&k,&k,dsa->q);
                if (!BN_is_zero(&k)) break;