diff options
| author | Stephan Müller <smueller@chronox.de> | 2020-07-20 19:07:48 +0200 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2020-07-31 18:08:58 +1000 |
| commit | be0f7db4659756372b238ad029a58bea7c4f99b6 (patch) | |
| tree | 77e858e35bcc1d4f757c25ae50fcb4d72b29d22f /crypto/ecc.c | |
| parent | 750b0c45c1f26f78f03ed03463bf8149d3dfc8ff (diff) | |
| download | linux-crypto-be0f7db4659756372b238ad029a58bea7c4f99b6.tar.gz linux-crypto-be0f7db4659756372b238ad029a58bea7c4f99b6.zip | |
crypto: ecdh - check validity of Z before export
SP800-56A rev3 section 5.7.1.2 step 2 mandates that the validity of the
calculated shared secret is verified before the data is returned to the
caller. Thus, the export function and the validity check functions are
reversed. In addition, the sensitive variables of priv and rand_z are
zeroized.
Signed-off-by: Stephan Mueller <smueller@chronox.de>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Acked-by: Neil Horman <nhorman@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto/ecc.c')
| -rw-r--r-- | crypto/ecc.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/crypto/ecc.c b/crypto/ecc.c index 86c32493..c8b259e5 100644 --- a/crypto/ecc.c +++ b/crypto/ecc.c @@ -1495,11 +1495,16 @@ int crypto_ecdh_shared_secret(unsigned int curve_id, unsigned int ndigits, ecc_point_mult(product, pk, priv, rand_z, curve, ndigits); - ecc_swap_digits(product->x, secret, ndigits); - - if (ecc_point_is_zero(product)) + if (ecc_point_is_zero(product)) { ret = -EFAULT; + goto err_validity; + } + + ecc_swap_digits(product->x, secret, ndigits); +err_validity: + memzero_explicit(priv, sizeof(priv)); + memzero_explicit(rand_z, sizeof(rand_z)); ecc_free_point(product); err_alloc_product: ecc_free_point(pk); |