crypto: ecc - check for invalid values in the key verification test

BugLink: https://bugs.launchpad.net/bugs/1857158
[ Upstream commit 2eb4942b6609d35a4e835644a33203b0aef7443d ]

Currently used scalar multiplication algorithm (Matthieu Rivain, 2011)
have invalid values for scalar == 1, n-1, and for regularized version
n-2, which was previously not checked. Verify that they are not used as
private keys.

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/crypto/ecc.c b/crypto/ecc.c
index 4ceec6a5c74e46560c6cb449c016ce22d382d33a..59bf7282d351e6f6b141debd65725e58a0bc8b25 100644 (file)
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -904,30 +904,43 @@ static inline void ecc_swap_digits(const u64 *in, u64 *out,
                out[i] = __swab64(in[ndigits - 1 - i]);
 }
 
-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
-                    const u64 *private_key, unsigned int private_key_len)
+static int __ecc_is_key_valid(const struct ecc_curve *curve,
+                             const u64 *private_key, unsigned int ndigits)
 {
-       int nbytes;
-       const struct ecc_curve *curve = ecc_get_curve(curve_id);
+       u64 one[ECC_MAX_DIGITS] = { 1, };
+       u64 res[ECC_MAX_DIGITS];
 
        if (!private_key)
                return -EINVAL;
 
-       nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
-
-       if (private_key_len != nbytes)
+       if (curve->g.ndigits != ndigits)
                return -EINVAL;
 
-       if (vli_is_zero(private_key, ndigits))
+       /* Make sure the private key is in the range [2, n-3]. */
+       if (vli_cmp(one, private_key, ndigits) != -1)
                return -EINVAL;
-
-       /* Make sure the private key is in the range [1, n-1]. */
-       if (vli_cmp(curve->n, private_key, ndigits) != 1)
+       vli_sub(res, curve->n, one, ndigits);
+       vli_sub(res, res, one, ndigits);
+       if (vli_cmp(res, private_key, ndigits) != 1)
                return -EINVAL;
 
        return 0;
 }
 
+int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
+                    const u64 *private_key, unsigned int private_key_len)
+{
+       int nbytes;
+       const struct ecc_curve *curve = ecc_get_curve(curve_id);
+
+       nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+
+       if (private_key_len != nbytes)
+               return -EINVAL;
+
+       return __ecc_is_key_valid(curve, private_key, ndigits);
+}
+
 /*
  * ECC private keys are generated using the method of extra random bits,
  * equivalent to that described in FIPS 186-4, Appendix B.4.1.
@@ -971,11 +984,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey)
        if (err)
                return err;
 
-       if (vli_is_zero(priv, ndigits))
-               return -EINVAL;
-
-       /* Make sure the private key is in the range [1, n-1]. */
-       if (vli_cmp(curve->n, priv, ndigits) != 1)
+       /* Make sure the private key is in the valid range. */
+       if (__ecc_is_key_valid(curve, priv, ndigits))
                return -EINVAL;
 
        ecc_swap_digits(priv, privkey, ndigits);