diff options
| author | Filippo Valsorda <filippo@golang.org> | 2022-03-31 12:31:58 -0400 |
|---|---|---|
| committer | Cherry Mui <cherryyz@google.com> | 2022-04-06 16:36:36 +0000 |
| commit | c9b9a010eb06e32e424dc8ffffcc37c8717ad03a (patch) | |
| tree | 5aee8bdd62765cb54b61c7aefd1fab3acfcdbea5 | |
| parent | f92bfa440facc9f31ef70105e3d957a6ca79efb7 (diff) | |
| download | go-c9b9a010eb06e32e424dc8ffffcc37c8717ad03a.tar.gz go-c9b9a010eb06e32e424dc8ffffcc37c8717ad03a.zip | |
[release-branch.go1.18] crypto/elliptic: tolerate zero-padded scalars in generic P-256
Updates #52075
Fixes #52077
Fixes CVE-2022-28327
Change-Id: I595a7514c9a0aa1b9c76aedfc2307e1124271f27
Reviewed-on: https://go-review.googlesource.com/c/go/+/397137
Trust: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Julie Qiu <julie@golang.org>
| -rw-r--r-- | src/crypto/elliptic/p256.go | 2 | ||||
| -rw-r--r-- | src/crypto/elliptic/p256_test.go | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/src/crypto/elliptic/p256.go b/src/crypto/elliptic/p256.go index e1c6ff4f87..99c39ea9d5 100644 --- a/src/crypto/elliptic/p256.go +++ b/src/crypto/elliptic/p256.go @@ -51,7 +51,7 @@ func p256GetScalar(out *[32]byte, in []byte) { n := new(big.Int).SetBytes(in) var scalarBytes []byte - if n.Cmp(p256Params.N) >= 0 { + if n.Cmp(p256Params.N) >= 0 || len(in) > len(out) { n.Mod(n, p256Params.N) scalarBytes = n.Bytes() } else { diff --git a/src/crypto/elliptic/p256_test.go b/src/crypto/elliptic/p256_test.go index c6862d9547..a607766bc6 100644 --- a/src/crypto/elliptic/p256_test.go +++ b/src/crypto/elliptic/p256_test.go @@ -136,3 +136,17 @@ func TestP256CombinedMult(t *testing.T) { t.Errorf("1×G + (-1)×G = (%d, %d), should be ∞", x, y) } } + +func TestIssue52075(t *testing.T) { + Gx, Gy := P256().Params().Gx, P256().Params().Gy + scalar := make([]byte, 33) + scalar[32] = 1 + x, y := P256().ScalarBaseMult(scalar) + if x.Cmp(Gx) != 0 || y.Cmp(Gy) != 0 { + t.Errorf("unexpected output (%v,%v)", x, y) + } + x, y = P256().ScalarMult(Gx, Gy, scalar) + if x.Cmp(Gx) != 0 || y.Cmp(Gy) != 0 { + t.Errorf("unexpected output (%v,%v)", x, y) + } +} |