Skip to content

Commit 915c59c

Browse files
JacobBarthelmehJacobBarthelmeh
committed
additional sanity checks on invalid input
1 parent 134f63a commit 915c59c

11 files changed

Lines changed: 798 additions & 162 deletions

File tree

‎tests/api/test_evp_pkey.c‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1592,9 +1592,19 @@ static int test_wolfSSL_EVP_PKEY_sign_verify(int keyType)
15921592
ExpectIntEQ(EVP_PKEY_verify(
15931593
ctx_verify, sig, siglen, hash, SHA256_DIGEST_LENGTH),
15941594
WOLFSSL_SUCCESS);
1595-
ExpectIntEQ(EVP_PKEY_verify(
1596-
ctx_verify, sig, siglen, zero, SHA256_DIGEST_LENGTH),
1597-
WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1595+
1596+
if (keyType == EVP_PKEY_EC) {
1597+
/* wolfSSL differs from OpenSSL in that it treats a hash of all 0's as a
1598+
* fatal error and does not attempt to verify */
1599+
ExpectIntEQ(EVP_PKEY_verify(
1600+
ctx_verify, sig, siglen, zero, SHA256_DIGEST_LENGTH),
1601+
WC_NO_ERR_TRACE(WOLFSSL_FATAL_ERROR));
1602+
}
1603+
else {
1604+
ExpectIntEQ(EVP_PKEY_verify(
1605+
ctx_verify, sig, siglen, zero, SHA256_DIGEST_LENGTH),
1606+
WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
1607+
}
15981608

15991609
#if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && defined(WOLFSSL_KEY_GEN) && \
16001610
!defined(HAVE_SELFTEST)

‎wolfcrypt/src/ecc.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7420,6 +7420,10 @@ int wc_ecc_sign_hash_ex(const byte* in, word32 inlen, WC_RNG* rng,
74207420
/* may still need bit truncation too */
74217421
if (err == MP_OKAY && (WOLFSSL_BIT_SIZE * inlen) > orderBits)
74227422
mp_rshb(e, (int)(WOLFSSL_BIT_SIZE - (orderBits & 0x7)));
7423+
7424+
if (err == MP_OKAY && mp_iszero(e)) {
7425+
err = ECC_BAD_ARG_E;
7426+
}
74237427
}
74247428

74257429
/* make up a key and export the public copy */
@@ -8999,6 +9003,10 @@ static int ecc_verify_hash(mp_int *r, mp_int *s, const byte* hash,
89999003
/* may still need bit truncation too */
90009004
if (err == MP_OKAY && (WOLFSSL_BIT_SIZE * hashlen) > orderBits)
90019005
mp_rshb(e, (int)(WOLFSSL_BIT_SIZE - (orderBits & 0x7)));
9006+
9007+
if (err == MP_OKAY && mp_iszero(e)) {
9008+
err = ECC_BAD_ARG_E;
9009+
}
90029010
}
90039011

90049012
/* check for async hardware acceleration */

‎wolfcrypt/src/sp_arm32.c‎

Lines changed: 107 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -79334,8 +79334,8 @@ static int sp_256_calc_s_8(sp_digit* s, const sp_digit* r, sp_digit* k,
7933479334
* rm First part of result as an mp_int.
7933579335
* sm Sirst part of result as an mp_int.
7933679336
* heap Heap to use for allocation.
79337-
* returns RNG failures, MEMORY_E when memory allocation fails and
79338-
* MP_OKAY on success.
79337+
* returns RNG failures, MEMORY_E when memory allocation fails,
79338+
* ECC_BAD_ARG_E with invalid argument, and MP_OKAY on success.
7933979339
*/
7934079340
int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
7934179341
const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap)
@@ -79365,6 +79365,11 @@ int sp_ecc_sign_256(const byte* hash, word32 hashLen, WC_RNG* rng,
7936579365
if (hashLen > 32U) {
7936679366
hashLen = 32U;
7936779367
}
79368+
79369+
sp_256_from_bin(e, 8, hash, (int)hashLen);
79370+
if (sp_256_iszero_8(e)) {
79371+
err = ECC_BAD_ARG_E;
79372+
}
7936879373
}
7936979374

7937079375
for (i = SP_ECC_MAX_SIG_GEN; err == MP_OKAY && i > 0; i--) {
@@ -79454,12 +79459,25 @@ int sp_ecc_sign_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, word32 hashLen, W
7945479459

7945579460
switch (ctx->state) {
7945679461
case 0: /* INIT */
79462+
{
79463+
word32 hl = hashLen;
79464+
7945779465
ctx->s = ctx->e;
7945879466
ctx->kInv = ctx->k;
7945979467

79460-
ctx->i = SP_ECC_MAX_SIG_GEN;
79461-
ctx->state = 1;
79462-
break;
79468+
if (hl > 32U) {
79469+
hl = 32U;
79470+
}
79471+
sp_256_from_bin(ctx->e, 8, hash, (int)hl);
79472+
if (sp_256_iszero_8(ctx->e)) {
79473+
err = ECC_BAD_ARG_E;
79474+
}
79475+
else {
79476+
ctx->i = SP_ECC_MAX_SIG_GEN;
79477+
ctx->state = 1;
79478+
}
79479+
}
79480+
break;
7946379481
case 1: /* GEN */
7946479482
/* New random point. */
7946579483
if (km == NULL || mp_iszero(km)) {
@@ -80576,7 +80594,12 @@ int sp_ecc_verify_256(const byte* hash, word32 hashLen, const mp_int* pX,
8057680594
sp_256_from_mp(p2->y, 8, pY);
8057780595
sp_256_from_mp(p2->z, 8, pZ);
8057880596

80579-
err = sp_256_calc_vfy_point_8(p1, p2, s, u1, u2, tmp, heap);
80597+
if (sp_256_iszero_8(u1)) {
80598+
err = ECC_BAD_ARG_E;
80599+
}
80600+
else {
80601+
err = sp_256_calc_vfy_point_8(p1, p2, s, u1, u2, tmp, heap);
80602+
}
8058080603
}
8058180604
if (err == MP_OKAY) {
8058280605
/* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */
@@ -80659,6 +80682,10 @@ int sp_ecc_verify_256_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash,
8065980682
sp_256_from_mp(ctx->p2.x, 8, pX);
8066080683
sp_256_from_mp(ctx->p2.y, 8, pY);
8066180684
sp_256_from_mp(ctx->p2.z, 8, pZ);
80685+
if (sp_256_iszero_8(ctx->u1)) {
80686+
err = ECC_BAD_ARG_E;
80687+
break;
80688+
}
8066280689
ctx->state = 1;
8066380690
break;
8066480691
case 1: /* NORMS0 */
@@ -97495,8 +97522,8 @@ static int sp_384_calc_s_12(sp_digit* s, const sp_digit* r, sp_digit* k,
9749597522
* rm First part of result as an mp_int.
9749697523
* sm Sirst part of result as an mp_int.
9749797524
* heap Heap to use for allocation.
97498-
* returns RNG failures, MEMORY_E when memory allocation fails and
97499-
* MP_OKAY on success.
97525+
* returns RNG failures, MEMORY_E when memory allocation fails,
97526+
* ECC_BAD_ARG_E with invalid argument, and MP_OKAY on success.
9750097527
*/
9750197528
int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
9750297529
const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap)
@@ -97526,6 +97553,11 @@ int sp_ecc_sign_384(const byte* hash, word32 hashLen, WC_RNG* rng,
9752697553
if (hashLen > 48U) {
9752797554
hashLen = 48U;
9752897555
}
97556+
97557+
sp_384_from_bin(e, 12, hash, (int)hashLen);
97558+
if (sp_384_iszero_12(e)) {
97559+
err = ECC_BAD_ARG_E;
97560+
}
9752997561
}
9753097562

9753197563
for (i = SP_ECC_MAX_SIG_GEN; err == MP_OKAY && i > 0; i--) {
@@ -97615,12 +97647,25 @@ int sp_ecc_sign_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, word32 hashLen, W
9761597647

9761697648
switch (ctx->state) {
9761797649
case 0: /* INIT */
97650+
{
97651+
word32 hl = hashLen;
97652+
9761897653
ctx->s = ctx->e;
9761997654
ctx->kInv = ctx->k;
9762097655

97621-
ctx->i = SP_ECC_MAX_SIG_GEN;
97622-
ctx->state = 1;
97623-
break;
97656+
if (hl > 48U) {
97657+
hl = 48U;
97658+
}
97659+
sp_384_from_bin(ctx->e, 12, hash, (int)hl);
97660+
if (sp_384_iszero_12(ctx->e)) {
97661+
err = ECC_BAD_ARG_E;
97662+
}
97663+
else {
97664+
ctx->i = SP_ECC_MAX_SIG_GEN;
97665+
ctx->state = 1;
97666+
}
97667+
}
97668+
break;
9762497669
case 1: /* GEN */
9762597670
/* New random point. */
9762697671
if (km == NULL || mp_iszero(km)) {
@@ -98859,7 +98904,12 @@ int sp_ecc_verify_384(const byte* hash, word32 hashLen, const mp_int* pX,
9885998904
sp_384_from_mp(p2->y, 12, pY);
9886098905
sp_384_from_mp(p2->z, 12, pZ);
9886198906

98862-
err = sp_384_calc_vfy_point_12(p1, p2, s, u1, u2, tmp, heap);
98907+
if (sp_384_iszero_12(u1)) {
98908+
err = ECC_BAD_ARG_E;
98909+
}
98910+
else {
98911+
err = sp_384_calc_vfy_point_12(p1, p2, s, u1, u2, tmp, heap);
98912+
}
9886398913
}
9886498914
if (err == MP_OKAY) {
9886598915
/* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */
@@ -98942,6 +98992,10 @@ int sp_ecc_verify_384_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash,
9894298992
sp_384_from_mp(ctx->p2.x, 12, pX);
9894398993
sp_384_from_mp(ctx->p2.y, 12, pY);
9894498994
sp_384_from_mp(ctx->p2.z, 12, pZ);
98995+
if (sp_384_iszero_12(ctx->u1)) {
98996+
err = ECC_BAD_ARG_E;
98997+
break;
98998+
}
9894598999
ctx->state = 1;
9894699000
break;
9894799001
case 1: /* NORMS0 */
@@ -125905,8 +125959,8 @@ static int sp_521_calc_s_17(sp_digit* s, const sp_digit* r, sp_digit* k,
125905125959
* rm First part of result as an mp_int.
125906125960
* sm Sirst part of result as an mp_int.
125907125961
* heap Heap to use for allocation.
125908-
* returns RNG failures, MEMORY_E when memory allocation fails and
125909-
* MP_OKAY on success.
125962+
* returns RNG failures, MEMORY_E when memory allocation fails,
125963+
* ECC_BAD_ARG_E with invalid argument, and MP_OKAY on success.
125910125964
*/
125911125965
int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
125912125966
const mp_int* priv, mp_int* rm, mp_int* sm, mp_int* km, void* heap)
@@ -125936,6 +125990,15 @@ int sp_ecc_sign_521(const byte* hash, word32 hashLen, WC_RNG* rng,
125936125990
if (hashLen > 66U) {
125937125991
hashLen = 66U;
125938125992
}
125993+
125994+
sp_521_from_bin(e, 17, hash, (int)hashLen);
125995+
if (hashLen == 66U) {
125996+
sp_521_rshift_17(e, e, 7);
125997+
}
125998+
125999+
if (sp_521_iszero_17(e)) {
126000+
err = ECC_BAD_ARG_E;
126001+
}
125939126002
}
125940126003

125941126004
for (i = SP_ECC_MAX_SIG_GEN; err == MP_OKAY && i > 0; i--) {
@@ -126030,12 +126093,29 @@ int sp_ecc_sign_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash, word32 hashLen, W
126030126093

126031126094
switch (ctx->state) {
126032126095
case 0: /* INIT */
126096+
{
126097+
word32 hl = hashLen;
126098+
126033126099
ctx->s = ctx->e;
126034126100
ctx->kInv = ctx->k;
126035126101

126036-
ctx->i = SP_ECC_MAX_SIG_GEN;
126037-
ctx->state = 1;
126038-
break;
126102+
if (hl > 66U) {
126103+
hl = 66U;
126104+
}
126105+
sp_521_from_bin(ctx->e, 17, hash, (int)hl);
126106+
if (hl == 66U) {
126107+
sp_521_rshift_17(ctx->e, ctx->e, 7);
126108+
}
126109+
126110+
if (sp_521_iszero_17(ctx->e)) {
126111+
err = ECC_BAD_ARG_E;
126112+
}
126113+
else {
126114+
ctx->i = SP_ECC_MAX_SIG_GEN;
126115+
ctx->state = 1;
126116+
}
126117+
}
126118+
break;
126039126119
case 1: /* GEN */
126040126120
/* New random point. */
126041126121
if (km == NULL || mp_iszero(km)) {
@@ -127800,7 +127880,12 @@ int sp_ecc_verify_521(const byte* hash, word32 hashLen, const mp_int* pX,
127800127880
sp_521_rshift_17(u1, u1, 7);
127801127881
}
127802127882

127803-
err = sp_521_calc_vfy_point_17(p1, p2, s, u1, u2, tmp, heap);
127883+
if (sp_521_iszero_17(u1)) {
127884+
err = ECC_BAD_ARG_E;
127885+
}
127886+
else {
127887+
err = sp_521_calc_vfy_point_17(p1, p2, s, u1, u2, tmp, heap);
127888+
}
127804127889
}
127805127890
if (err == MP_OKAY) {
127806127891
/* (r + n*order).z'.z' mod prime == (u1.G + u2.Q)->x' */
@@ -127886,6 +127971,10 @@ int sp_ecc_verify_521_nb(sp_ecc_ctx_t* sp_ctx, const byte* hash,
127886127971
if (hashLen == 66U) {
127887127972
sp_521_rshift_17(ctx->u1, ctx->u1, 7);
127888127973
}
127974+
if (sp_521_iszero_17(ctx->u1)) {
127975+
err = ECC_BAD_ARG_E;
127976+
break;
127977+
}
127889127978
ctx->state = 1;
127890127979
break;
127891127980
case 1: /* NORMS0 */

0 commit comments

Comments
 (0)