Deprecate the flags that switch off constant time

The flags RSA_FLAG_NO_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME and
DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch
off the constant time implementation for RSA, DSA and DH have been made
no-ops and deprecated.

Reviewed-by: Richard Levitte <levitte@openssl.org>

2 files changed, 22 insertions, 36 deletions

diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c
index 2bb84543d6..aa5d42ce17 100644
--- a/crypto/dsa/dsa_key.c
+++ b/crypto/dsa/dsa_key.c
@@ -50,24 +50,18 @@ static int dsa_builtin_keygen(DSA *dsa)
         pub_key = dsa->pub_key;
 
     {
-        BIGNUM *local_prk = NULL;
-        BIGNUM *prk;
+        BIGNUM *prk = BN_new();
 
-        if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
-            local_prk = prk = BN_new();
-            if (local_prk == NULL)
-                goto err;
-            BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
-        } else {
-            prk = priv_key;
-        }
+        if (prk == NULL)
+            goto err;
+        BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
 
         if (!BN_mod_exp(pub_key, dsa->g, prk, dsa->p, ctx)) {
-            BN_free(local_prk);
+            BN_free(prk);
             goto err;
         }
-        /* We MUST free local_prk before any further use of priv_key */
-        BN_free(local_prk);
+        /* We MUST free prk before any further use of priv_key */
+        BN_free(prk);
     }
 
     dsa->priv_key = priv_key;
diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c
index 2bc1887a98..ea09afd953 100644
--- a/crypto/dsa/dsa_ossl.c
+++ b/crypto/dsa/dsa_ossl.c
@@ -135,7 +135,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
                           const unsigned char *dgst, int dlen)
 {
     BN_CTX *ctx = NULL;
-    BIGNUM *k, *kq, *K, *kinv = NULL, *r = *rp;
+    BIGNUM *k, *kq, *kinv = NULL, *r = *rp;
     int ret = 0;
 
     if (!dsa->p || !dsa->q || !dsa->g) {
@@ -176,39 +176,31 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
 
     /* Compute r = (g^k mod p) mod q */
 
-    if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
-        if (!BN_copy(kq, k))
-            goto err;
+    if (!BN_copy(kq, k))
+        goto err;
 
-        /*
-         * We do not want timing information to leak the length of k, so we
-         * compute g^k using an equivalent exponent of fixed length. (This
-         * is a kludge that we need because the BN_mod_exp_mont() does not
-         * let us specify the desired timing behaviour.)
-         */
+    /*
+     * We do not want timing information to leak the length of k, so we
+     * compute g^k using an equivalent exponent of fixed length. (This
+     * is a kludge that we need because the BN_mod_exp_mont() does not
+     * let us specify the desired timing behaviour.)
+     */
 
+    if (!BN_add(kq, kq, dsa->q))
+        goto err;
+    if (BN_num_bits(kq) <= BN_num_bits(dsa->q)) {
         if (!BN_add(kq, kq, dsa->q))
             goto err;
-        if (BN_num_bits(kq) <= BN_num_bits(dsa->q)) {
-            if (!BN_add(kq, kq, dsa->q))
-                goto err;
-        }
-
-        K = kq;
-    } else {
-        K = k;
     }
 
-    if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) {
-        BN_set_flags(K, BN_FLG_CONSTTIME);
-    }
+    BN_set_flags(kq, BN_FLG_CONSTTIME);
 
     if ((dsa)->meth->bn_mod_exp != NULL) {
-            if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, K, dsa->p, ctx,
+            if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, kq, dsa->p, ctx,
                                        dsa->method_mont_p))
                 goto err;
     } else {
-            if (!BN_mod_exp_mont(r, dsa->g, K, dsa->p, ctx, dsa->method_mont_p))
+            if (!BN_mod_exp_mont(r, dsa->g, kq, dsa->p, ctx, dsa->method_mont_p))
                 goto err;
     }