From 7b2b66e3f3cbe8b56288d741ac5909f86d1994b8 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 31 Mar 2021 22:50:57 +0200 Subject: [PATCH] DHM blinding: don't accept P-1 as a blinding value P-1 is as bad as 1 as a blinding value. Don't accept it. The chance that P-1 would be randomly generated is infinitesimal, so this is not a practical issue, but it makes the code cleaner. It was inconsistent to accept P-1 as a blinding value but not as a private key. Signed-off-by: Gilles Peskine --- library/dhm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/dhm.c b/library/dhm.c index f2ad551ceb..5e0864b329 100644 --- a/library/dhm.c +++ b/library/dhm.c @@ -329,7 +329,7 @@ static int dhm_random_below( mbedtls_mpi *R, const mbedtls_mpi *M, if( count++ > 10 ) return( MBEDTLS_ERR_MPI_NOT_ACCEPTABLE ); } - while( mbedtls_mpi_cmp_int( R, 1 ) <= 0 ); + while( dhm_check_range( R, M ) != 0 ); cleanup: return( ret ); @@ -382,7 +382,7 @@ static int dhm_update_blinding( mbedtls_dhm_context *ctx, * We need to generate blinding values from scratch */ - /* Vi = random( 2, P-1 ) */ + /* Vi = random( 2, P-2 ) */ MBEDTLS_MPI_CHK( dhm_random_below( &ctx->Vi, &ctx->P, f_rng, p_rng ) ); /* Vf = Vi^-X mod P