linux-kernel - Re: [PATCH v2] crypto: ecc - regularize scalar for scalar multiplication

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181116061958.yary7zcu5m3pnolb@gondor.apana.org.au>
Date:   Fri, 16 Nov 2018 14:19:58 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Vitaly Chikunov <vt@...linux.org>
Cc:     "David S. Miller" <davem@...emloft.net>,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v2] crypto: ecc - regularize scalar for scalar
 multiplication

On Sun, Nov 11, 2018 at 08:40:02PM +0300, Vitaly Chikunov wrote:
> ecc_point_mult is supposed to be used with a regularized scalar,
> otherwise, it's possible to deduce the position of the top bit of the
> scalar with timing attack. This is important when the scalar is a
> private key.
> 
> ecc_point_mult is already using a regular algorithm (i.e. having an
> operation flow independent of the input scalar) but regularization step
> is not implemented.
> 
> Arrange scalar to always have fixed top bit by adding a multiple of the
> curve order (n).
> 
> References:
> The constant time regularization step is based on micro-ecc by Kenneth
> MacKay and also referenced in the literature (Bernstein, D. J., & Lange,
> T. (2017). Montgomery curves and the Montgomery ladder. (Cryptology
> ePrint Archive; Vol. 2017/293). s.l.: IACR. Chapter 4.6.2.)
> 
> Signed-off-by: Vitaly Chikunov <vt@...linux.org>
> Cc: kernel-hardening@...ts.openwall.com
> ---
> 
> Changes from v1:
> - No code changes, only description updates to be more informative.
> 
>  crypto/ecc.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt