diff options
| author | Filippo Valsorda <filippo@golang.org> | 2019-01-22 16:02:41 -0500 |
|---|---|---|
| committer | Julie Qiu <julieqiu@google.com> | 2019-01-23 17:29:02 +0000 |
| commit | 42b42f71cf8f5956c09e66230293dfb5db652360 (patch) | |
| tree | ff2e3ea6185377d2524b84028dcca03616c5cb0f | |
| parent | 4601a4c1b1c00fbe507508f0267ec5a9445bb7e5 (diff) | |
| download | go-42b42f71cf8f5956c09e66230293dfb5db652360.tar.gz go-42b42f71cf8f5956c09e66230293dfb5db652360.zip | |
[release-branch.go1.11-security] crypto/elliptic: reduce subtraction term to prevent long busy loop
If beta8 is unusually large, the addition loop might take a very long
time to bring x3-beta8 back positive.
This would lead to a DoS vulnerability in the implementation of the
P-521 and P-384 elliptic curves that may let an attacker craft inputs
to ScalarMult that consume excessive amounts of CPU.
This fixes CVE-2019-6486.
Change-Id: Ia969e8b5bf5ac4071a00722de9d5e4d856d8071a
Reviewed-on: https://team-review.git.corp.google.com/c/399777
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
(cherry picked from commit 746d6abe2dfb9ce7609f8e1e1a8dcb7e221f423e)
Reviewed-on: https://team-review.git.corp.google.com/c/401142
Reviewed-by: Filippo Valsorda <valsorda@google.com>
| -rw-r--r-- | src/crypto/elliptic/elliptic.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go index 4fc2b5e521..c84657c5e3 100644 --- a/src/crypto/elliptic/elliptic.go +++ b/src/crypto/elliptic/elliptic.go @@ -210,8 +210,9 @@ func (curve *CurveParams) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, x3 := new(big.Int).Mul(alpha, alpha) beta8 := new(big.Int).Lsh(beta, 3) + beta8.Mod(beta8, curve.P) x3.Sub(x3, beta8) - for x3.Sign() == -1 { + if x3.Sign() == -1 { x3.Add(x3, curve.P) } x3.Mod(x3, curve.P) |