From 223c80ea7d11a75f0b577dba8fc103090aa434ff Mon Sep 17 00:00:00 2001 From: =?utf8?q?Bodo=20M=C3=B6ller?= Date: Wed, 2 Apr 2003 09:50:17 +0000 Subject: [PATCH] make RSA blinding thread-safe --- CHANGES | 9 +++- crypto/bn/bn.h | 2 + crypto/rsa/rsa.h | 1 + crypto/rsa/rsa_eay.c | 114 ++++++++++++++++++++++++++++++++++++++++--- crypto/rsa/rsa_err.c | 3 +- crypto/rsa/rsa_lib.c | 11 ++++- util/mkerr.pl | 2 +- 7 files changed, 128 insertions(+), 14 deletions(-) diff --git a/CHANGES b/CHANGES index f234afa9e5..df556aae46 100644 --- a/CHANGES +++ b/CHANGES @@ -14,12 +14,17 @@ to avoid a timing attack. Applications that don't want it can call RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING. They would be ill-advised to do so in most cases. - [Ben Laurie, Steve Henson, Geoff Thorpe] + [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller] *) Change RSA blinding code so that it works when the PRNG is not seeded (in this case, the secret RSA exponent is abused as an unpredictable seed -- if it is not unpredictable, there - is no point in blinding anyway). + is no point in blinding anyway). Make RSA blinding thread-safe + by remembering the creator's thread ID in rsa->blinding and + having all other threads use local one-time blinding factors + (this requires more computation than sharing rsa->blinding, but + avoids excessive locking; and if an RSA object is not shared + between threads, blinding will still be very fast). [Bodo Moeller] Changes between 0.9.6h and 0.9.6i [19 Feb 2003] diff --git a/crypto/bn/bn.h b/crypto/bn/bn.h index c0d6b1612d..74b7347523 100644 --- a/crypto/bn/bn.h +++ b/crypto/bn/bn.h @@ -259,6 +259,8 @@ typedef struct bn_blinding_st BIGNUM *A; BIGNUM *Ai; BIGNUM *mod; /* just a reference */ + unsigned long thread_id; /* added in OpenSSL 0.9.6j and 0.9.7b; + * used only by crypto/rsa/rsa_eay.c, rsa_lib.c */ } BN_BLINDING; /* Used for montgomery multiplication */ diff --git a/crypto/rsa/rsa.h b/crypto/rsa/rsa.h index 6844ee9d28..ffe00aeadc 100644 --- a/crypto/rsa/rsa.h +++ b/crypto/rsa/rsa.h @@ -336,6 +336,7 @@ void ERR_load_RSA_strings(void); #define RSA_R_DMP1_NOT_CONGRUENT_TO_D 124 #define RSA_R_DMQ1_NOT_CONGRUENT_TO_D 125 #define RSA_R_D_E_NOT_CONGRUENT_TO_1 123 +#define RSA_R_INTERNAL_ERROR 133 #define RSA_R_INVALID_MESSAGE_LENGTH 131 #define RSA_R_IQMP_NOT_INVERSE_OF_Q 126 #define RSA_R_KEY_SIZE_TOO_SMALL 120 diff --git a/crypto/rsa/rsa_eay.c b/crypto/rsa/rsa_eay.c index e5f23fd684..866406406b 100644 --- a/crypto/rsa/rsa_eay.c +++ b/crypto/rsa/rsa_eay.c @@ -209,6 +209,40 @@ static int rsa_eay_blinding(RSA *rsa, BN_CTX *ctx) err_instr \ } while(0) +static BN_BLINDING *setup_blinding(RSA *rsa, BN_CTX *ctx) + { + BIGNUM *A, *Ai; + BN_BLINDING *ret = NULL; + + /* added in OpenSSL 0.9.6j and 0.9.7b */ + + /* NB: similar code appears in RSA_blinding_on (rsa_lib.c); + * this should be placed in a new function of its own, but for reasons + * of binary compatibility can't */ + + BN_CTX_start(ctx); + A = BN_CTX_get(ctx); + if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL) + { + /* if PRNG is not properly seeded, resort to secret exponent as unpredictable seed */ + RAND_add(rsa->d->d, rsa->d->dmax * sizeof rsa->d->d[0], 0); + if (!BN_pseudo_rand_range(A,rsa->n)) goto err; + } + else + { + if (!BN_rand_range(A,rsa->n)) goto err; + } + if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err; + + if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) + goto err; + ret = BN_BLINDING_new(A,Ai,rsa->n); + BN_free(Ai); +err: + BN_CTX_end(ctx); + return ret; + } + /* signing */ static int RSA_eay_private_encrypt(int flen, unsigned char *from, unsigned char *to, RSA *rsa, int padding) @@ -217,6 +251,8 @@ static int RSA_eay_private_encrypt(int flen, unsigned char *from, int i,j,k,num=0,r= -1; unsigned char *buf=NULL; BN_CTX *ctx=NULL; + int local_blinding = 0; + BN_BLINDING *blinding = NULL; BN_init(&f); BN_init(&ret); @@ -254,9 +290,38 @@ static int RSA_eay_private_encrypt(int flen, unsigned char *from, } BLINDING_HELPER(rsa, ctx, goto err;); - + blinding = rsa->blinding; + + /* Now unless blinding is disabled, 'blinding' is non-NULL. + * But the BN_BLINDING object may be owned by some other thread + * (we don't want to keep it constant and we don't want to use + * lots of locking to avoid race conditions, so only a single + * thread can use it; other threads have to use local blinding + * factors) */ if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) - if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; + { + if (blinding == NULL) + { + RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, RSA_R_INTERNAL_ERROR); + goto err; + } + } + + if (blinding != NULL) + { + if (blinding->thread_id != CRYPTO_thread_id()) + { + /* we need a local one-time blinding factor */ + + blinding = setup_blinding(rsa, ctx); + if (blinding == NULL) + goto err; + local_blinding = 1; + } + } + + if (blinding) + if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err; if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || ((rsa->p != NULL) && @@ -270,8 +335,8 @@ static int RSA_eay_private_encrypt(int flen, unsigned char *from, if (!rsa->meth->bn_mod_exp(&ret,&f,rsa->d,rsa->n,ctx,NULL)) goto err; } - if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) - if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err; + if (blinding) + if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err; /* put in leading 0 bytes if the number is less than the * length of the modulus */ @@ -285,6 +350,8 @@ err: if (ctx != NULL) BN_CTX_free(ctx); BN_clear_free(&ret); BN_clear_free(&f); + if (local_blinding) + BN_BLINDING_free(blinding); if (buf != NULL) { OPENSSL_cleanse(buf,num); @@ -301,6 +368,8 @@ static int RSA_eay_private_decrypt(int flen, unsigned char *from, unsigned char *p; unsigned char *buf=NULL; BN_CTX *ctx=NULL; + int local_blinding = 0; + BN_BLINDING *blinding = NULL; BN_init(&f); BN_init(&ret); @@ -333,9 +402,38 @@ static int RSA_eay_private_decrypt(int flen, unsigned char *from, } BLINDING_HELPER(rsa, ctx, goto err;); - + blinding = rsa->blinding; + + /* Now unless blinding is disabled, 'blinding' is non-NULL. + * But the BN_BLINDING object may be owned by some other thread + * (we don't want to keep it constant and we don't want to use + * lots of locking to avoid race conditions, so only a single + * thread can use it; other threads have to use local blinding + * factors) */ if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) - if (!BN_BLINDING_convert(&f,rsa->blinding,ctx)) goto err; + { + if (blinding == NULL) + { + RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_INTERNAL_ERROR); + goto err; + } + } + + if (blinding != NULL) + { + if (blinding->thread_id != CRYPTO_thread_id()) + { + /* we need a local one-time blinding factor */ + + blinding = setup_blinding(rsa, ctx); + if (blinding == NULL) + goto err; + local_blinding = 1; + } + } + + if (blinding) + if (!BN_BLINDING_convert(&f, blinding, ctx)) goto err; /* do the decrypt */ if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || @@ -351,8 +449,8 @@ static int RSA_eay_private_decrypt(int flen, unsigned char *from, goto err; } - if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) - if (!BN_BLINDING_invert(&ret,rsa->blinding,ctx)) goto err; + if (blinding) + if (!BN_BLINDING_invert(&ret, blinding, ctx)) goto err; p=buf; j=BN_bn2bin(&ret,p); /* j is only used with no-padding mode */ diff --git a/crypto/rsa/rsa_err.c b/crypto/rsa/rsa_err.c index bff7cf5d12..be10200de1 100644 --- a/crypto/rsa/rsa_err.c +++ b/crypto/rsa/rsa_err.c @@ -1,6 +1,6 @@ /* crypto/rsa/rsa_err.c */ /* ==================================================================== - * Copyright (c) 1999 The OpenSSL Project. All rights reserved. + * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -113,6 +113,7 @@ static ERR_STRING_DATA RSA_str_reasons[]= {RSA_R_DMP1_NOT_CONGRUENT_TO_D ,"dmp1 not congruent to d"}, {RSA_R_DMQ1_NOT_CONGRUENT_TO_D ,"dmq1 not congruent to d"}, {RSA_R_D_E_NOT_CONGRUENT_TO_1 ,"d e not congruent to 1"}, +{RSA_R_INTERNAL_ERROR ,"internal error"}, {RSA_R_INVALID_MESSAGE_LENGTH ,"invalid message length"}, {RSA_R_IQMP_NOT_INVERSE_OF_Q ,"iqmp not inverse of q"}, {RSA_R_KEY_SIZE_TOO_SMALL ,"key size too small"}, diff --git a/crypto/rsa/rsa_lib.c b/crypto/rsa/rsa_lib.c index d6854591f6..d7d36d2019 100644 --- a/crypto/rsa/rsa_lib.c +++ b/crypto/rsa/rsa_lib.c @@ -273,6 +273,10 @@ int RSA_blinding_on(RSA *rsa, BN_CTX *p_ctx) if (rsa->blinding != NULL) BN_BLINDING_free(rsa->blinding); + /* NB: similar code appears in setup_blinding (rsa_eay.c); + * this should be placed in a new function of its own, but for reasons + * of binary compatibility can't */ + BN_CTX_start(ctx); A = BN_CTX_get(ctx); if ((RAND_status() == 0) && rsa->d != NULL && rsa->d->d != NULL) @@ -288,8 +292,11 @@ int RSA_blinding_on(RSA *rsa, BN_CTX *p_ctx) if ((Ai=BN_mod_inverse(NULL,A,rsa->n,ctx)) == NULL) goto err; if (!rsa->meth->bn_mod_exp(A,A,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) - goto err; - rsa->blinding=BN_BLINDING_new(A,Ai,rsa->n); + goto err; + if ((rsa->blinding=BN_BLINDING_new(A,Ai,rsa->n)) == NULL) goto err; + /* to make things thread-safe without excessive locking, + * rsa->blinding will be used just by the current thread: */ + rsa->blinding->thread_id = CRYPTO_thread_id(); rsa->flags |= RSA_FLAG_BLINDING; rsa->flags &= ~RSA_FLAG_NO_BLINDING; BN_free(Ai); diff --git a/util/mkerr.pl b/util/mkerr.pl index 449aa57bba..4eca98689f 100644 --- a/util/mkerr.pl +++ b/util/mkerr.pl @@ -320,7 +320,7 @@ EOF print OUT <<"EOF"; /* $cfile */ /* ==================================================================== - * Copyright (c) 1999-2002 The OpenSSL Project. All rights reserved. + * Copyright (c) 1999-2003 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions -- 2.25.1