diff options
Diffstat (limited to 'crypto/dsa')
-rw-r--r-- | crypto/dsa/dsa_key.c | 20 | ||||
-rw-r--r-- | crypto/dsa/dsa_ossl.c | 38 |
2 files changed, 22 insertions, 36 deletions
diff --git a/crypto/dsa/dsa_key.c b/crypto/dsa/dsa_key.c index 2bb84543d6..aa5d42ce17 100644 --- a/crypto/dsa/dsa_key.c +++ b/crypto/dsa/dsa_key.c @@ -50,24 +50,18 @@ static int dsa_builtin_keygen(DSA *dsa) pub_key = dsa->pub_key; { - BIGNUM *local_prk = NULL; - BIGNUM *prk; + BIGNUM *prk = BN_new(); - if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) { - local_prk = prk = BN_new(); - if (local_prk == NULL) - goto err; - BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); - } else { - prk = priv_key; - } + if (prk == NULL) + goto err; + BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME); if (!BN_mod_exp(pub_key, dsa->g, prk, dsa->p, ctx)) { - BN_free(local_prk); + BN_free(prk); goto err; } - /* We MUST free local_prk before any further use of priv_key */ - BN_free(local_prk); + /* We MUST free prk before any further use of priv_key */ + BN_free(prk); } dsa->priv_key = priv_key; diff --git a/crypto/dsa/dsa_ossl.c b/crypto/dsa/dsa_ossl.c index 2bc1887a98..ea09afd953 100644 --- a/crypto/dsa/dsa_ossl.c +++ b/crypto/dsa/dsa_ossl.c @@ -135,7 +135,7 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, const unsigned char *dgst, int dlen) { BN_CTX *ctx = NULL; - BIGNUM *k, *kq, *K, *kinv = NULL, *r = *rp; + BIGNUM *k, *kq, *kinv = NULL, *r = *rp; int ret = 0; if (!dsa->p || !dsa->q || !dsa->g) { @@ -176,39 +176,31 @@ static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, /* Compute r = (g^k mod p) mod q */ - if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) { - if (!BN_copy(kq, k)) - goto err; + if (!BN_copy(kq, k)) + goto err; - /* - * We do not want timing information to leak the length of k, so we - * compute g^k using an equivalent exponent of fixed length. (This - * is a kludge that we need because the BN_mod_exp_mont() does not - * let us specify the desired timing behaviour.) - */ + /* + * We do not want timing information to leak the length of k, so we + * compute g^k using an equivalent exponent of fixed length. (This + * is a kludge that we need because the BN_mod_exp_mont() does not + * let us specify the desired timing behaviour.) + */ + if (!BN_add(kq, kq, dsa->q)) + goto err; + if (BN_num_bits(kq) <= BN_num_bits(dsa->q)) { if (!BN_add(kq, kq, dsa->q)) goto err; - if (BN_num_bits(kq) <= BN_num_bits(dsa->q)) { - if (!BN_add(kq, kq, dsa->q)) - goto err; - } - - K = kq; - } else { - K = k; } - if ((dsa->flags & DSA_FLAG_NO_EXP_CONSTTIME) == 0) { - BN_set_flags(K, BN_FLG_CONSTTIME); - } + BN_set_flags(kq, BN_FLG_CONSTTIME); if ((dsa)->meth->bn_mod_exp != NULL) { - if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, K, dsa->p, ctx, + if (!dsa->meth->bn_mod_exp(dsa, r, dsa->g, kq, dsa->p, ctx, dsa->method_mont_p)) goto err; } else { - if (!BN_mod_exp_mont(r, dsa->g, K, dsa->p, ctx, dsa->method_mont_p)) + if (!BN_mod_exp_mont(r, dsa->g, kq, dsa->p, ctx, dsa->method_mont_p)) goto err; } |