grpc 1.53.1 → 1.57.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/exponentiation.c

@@ -109,10 +109,10 @@
 #include <openssl/bn.h>
 
 #include <assert.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 
-#include <openssl/cpu.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
@@ -397,7 +397,7 @@ err:
 //
 // (with draws in between).  Very small exponents are often selected
 // with low Hamming weight, so we use  w = 1  for b <= 23.
-static int BN_window_bits_for_exponent_size(int b) {
+static int BN_window_bits_for_exponent_size(size_t b) {
   if (b > 671) {
     return 6;
   }
@@ -444,6 +444,7 @@ static int mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
     return BN_one(r);
   }
 
+  BN_RECP_CTX_init(&recp);
   BN_CTX_start(ctx);
   aa = BN_CTX_get(ctx);
   val[0] = BN_CTX_get(ctx);
@@ -451,7 +452,6 @@ static int mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
     goto err;
   }
 
-  BN_RECP_CTX_init(&recp);
   if (m->neg) {
     // ignore sign of 'm'
     if (!BN_copy(aa, m)) {
@@ -594,7 +594,8 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
     return 0;
   }
-  if (a->neg || BN_ucmp(a, m) >= 0) {
+  // |a| is secret, but |a < m| is not.
+  if (a->neg || constant_time_declassify_int(BN_ucmp(a, m)) >= 0) {
     OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED);
     return 0;
   }
@@ -722,12 +723,14 @@ err:
 void bn_mod_exp_mont_small(BN_ULONG *r, const BN_ULONG *a, size_t num,
                            const BN_ULONG *p, size_t num_p,
                            const BN_MONT_CTX *mont) {
-  if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) {
+  if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS ||
+      num_p > ((size_t)-1) / BN_BITS2) {
     abort();
   }
   assert(BN_is_odd(&mont->N));
 
-  // Count the number of bits in |p|. Note this function treats |p| as public.
+  // Count the number of bits in |p|, skipping leading zeros. Note this function
+  // treats |p| as public.
   while (num_p != 0 && p[num_p - 1] == 0) {
     num_p--;
   }
@@ -735,7 +738,7 @@ void bn_mod_exp_mont_small(BN_ULONG *r, const BN_ULONG *a, size_t num,
     bn_from_montgomery_small(r, num, mont->RR.d, num, mont);
     return;
   }
-  unsigned bits = BN_num_bits_word(p[num_p - 1]) + (num_p - 1) * BN_BITS2;
+  size_t bits = BN_num_bits_word(p[num_p - 1]) + (num_p - 1) * BN_BITS2;
   assert(bits != 0);
 
   // We exponentiate by looking at sliding windows of the exponent and
@@ -759,7 +762,7 @@ void bn_mod_exp_mont_small(BN_ULONG *r, const BN_ULONG *a, size_t num,
   // |p| is non-zero, so at least one window is non-zero. To save some
   // multiplications, defer initializing |r| until then.
   int r_is_one = 1;
-  unsigned wstart = bits - 1;  // The top bit of the window.
+  size_t wstart = bits - 1;  // The top bit of the window.
   for (;;) {
     if (!bn_is_bit_set_words(p, num_p, wstart)) {
       if (!r_is_one) {
@@ -849,7 +852,11 @@ static int copy_from_prebuf(BIGNUM *b, int top, const BN_ULONG *table, int idx,
   OPENSSL_memset(b->d, 0, sizeof(BN_ULONG) * top);
   const int width = 1 << window;
   for (int i = 0; i < width; i++, table += top) {
-    BN_ULONG mask = constant_time_eq_int(i, idx);
+    // Use a value barrier to prevent Clang from adding a branch when |i != idx|
+    // and making this copy not constant time. Clang is still allowed to learn
+    // that |mask| is constant across the inner loop, so this won't inhibit any
+    // vectorization it might do.
+    BN_ULONG mask = value_barrier_w(constant_time_eq_int(i, idx));
     for (int j = 0; j < top; j++) {
       b->d[j] |= table[j] & mask;
     }
@@ -859,40 +866,15 @@ static int copy_from_prebuf(BIGNUM *b, int top, const BN_ULONG *table, int idx,
   return 1;
 }
 
-#define MOD_EXP_CTIME_MIN_CACHE_LINE_MASK \
-  (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - 1)
-
 // Window sizes optimized for fixed window size modular exponentiation
 // algorithm (BN_mod_exp_mont_consttime).
 //
-// To achieve the security goals of BN_mode_exp_mont_consttime, the maximum
-// size of the window must not exceed
-// log_2(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH).
-//
-// Window size thresholds are defined for cache line sizes of 32 and 64, cache
-// line sizes where log_2(32)=5 and log_2(64)=6 respectively. A window size of
-// 7 should only be used on processors that have a 128 byte or greater cache
-// line size.
-#if MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 64
-
+// TODO(davidben): These window sizes were originally set for 64-byte cache
+// lines with a cache-line-dependent constant-time mitigation. They can probably
+// be revised now that our implementation is no longer cache-time-dependent.
 #define BN_window_bits_for_ctime_exponent_size(b) \
   ((b) > 937 ? 6 : (b) > 306 ? 5 : (b) > 89 ? 4 : (b) > 22 ? 3 : 1)
-#define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (6)
-
-#elif MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH == 32
-
-#define BN_window_bits_for_ctime_exponent_size(b) \
-  ((b) > 306 ? 5 : (b) > 89 ? 4 : (b) > 22 ? 3 : 1)
-#define BN_MAX_WINDOW_BITS_FOR_CTIME_EXPONENT_SIZE (5)
-
-#endif
-
-// Given a pointer value, compute the next address that is a cache line
-// multiple.
-#define MOD_EXP_CTIME_ALIGN(x_)          \
-  ((unsigned char *)(x_) +               \
-   (MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH - \
-    (((size_t)(x_)) & (MOD_EXP_CTIME_MIN_CACHE_LINE_MASK))))
+#define BN_MAX_MOD_EXP_CTIME_WINDOW (6)
 
 // This variant of |BN_mod_exp_mont| uses fixed windows and fixed memory access
 // patterns to protect secret exponents (cf. the hyper-threading timing attacks
@@ -901,14 +883,12 @@ static int copy_from_prebuf(BIGNUM *b, int top, const BN_ULONG *table, int idx,
 int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                               const BIGNUM *m, BN_CTX *ctx,
                               const BN_MONT_CTX *mont) {
-  int i, ret = 0, window, wvalue;
+  int i, ret = 0, wvalue;
   BN_MONT_CTX *new_mont = NULL;
 
-  int numPowers;
-  unsigned char *powerbufFree = NULL;
-  int powerbufLen = 0;
+  unsigned char *powerbuf_free = NULL;
+  size_t powerbuf_len = 0;
   BN_ULONG *powerbuf = NULL;
-  BIGNUM tmp, am;
 
   if (!BN_is_odd(m)) {
     OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
@@ -954,8 +934,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
   // paths. If we were to use separate static buffers for each then there is
   // some chance that both large buffers would be allocated on the stack,
   // causing the stack space requirement to be truly huge (~10KB).
-  alignas(MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH) BN_ULONG
-    storage[MOD_EXP_CTIME_STORAGE_LEN];
+  alignas(MOD_EXP_CTIME_ALIGN) BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN];
 #endif
 #if defined(RSAZ_ENABLED)
   // If the size of the operands allow it, perform the optimized RSAZ
@@ -976,112 +955,115 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 #endif
 
   // Get the window size to use with size of p.
-  window = BN_window_bits_for_ctime_exponent_size(bits);
+  int window = BN_window_bits_for_ctime_exponent_size(bits);
+  assert(window <= BN_MAX_MOD_EXP_CTIME_WINDOW);
+
+  // Calculating |powerbuf_len| below cannot overflow because of the bound on
+  // Montgomery reduction.
+  assert((size_t)top <= BN_MONTGOMERY_MAX_WORDS);
+  static_assert(
+      BN_MONTGOMERY_MAX_WORDS <=
+          INT_MAX / sizeof(BN_ULONG) / ((1 << BN_MAX_MOD_EXP_CTIME_WINDOW) + 3),
+      "powerbuf_len may overflow");
+
 #if defined(OPENSSL_BN_ASM_MONT5)
   if (window >= 5) {
     window = 5;  // ~5% improvement for RSA2048 sign, and even for RSA4096
-    // reserve space for mont->N.d[] copy
-    powerbufLen += top * sizeof(mont->N.d[0]);
+    // Reserve space for the |mont->N| copy.
+    powerbuf_len += top * sizeof(mont->N.d[0]);
   }
 #endif
 
   // Allocate a buffer large enough to hold all of the pre-computed
-  // powers of am, am itself and tmp.
-  numPowers = 1 << window;
-  powerbufLen +=
-      sizeof(m->d[0]) *
-      (top * numPowers + ((2 * top) > numPowers ? (2 * top) : numPowers));
+  // powers of |am|, |am| itself, and |tmp|.
+  int num_powers = 1 << window;
+  powerbuf_len += sizeof(m->d[0]) * top * (num_powers + 2);
 
 #if defined(OPENSSL_BN_ASM_MONT5)
-  if ((size_t)powerbufLen <= sizeof(storage)) {
+  if (powerbuf_len <= sizeof(storage)) {
     powerbuf = storage;
   }
   // |storage| is more than large enough to handle 1024-bit inputs.
   assert(powerbuf != NULL || top * BN_BITS2 > 1024);
 #endif
   if (powerbuf == NULL) {
-    powerbufFree =
-        OPENSSL_malloc(powerbufLen + MOD_EXP_CTIME_MIN_CACHE_LINE_WIDTH);
-    if (powerbufFree == NULL) {
+    powerbuf_free = OPENSSL_malloc(powerbuf_len + MOD_EXP_CTIME_ALIGN);
+    if (powerbuf_free == NULL) {
       goto err;
     }
-    powerbuf = (BN_ULONG *)MOD_EXP_CTIME_ALIGN(powerbufFree);
+    powerbuf = align_pointer(powerbuf_free, MOD_EXP_CTIME_ALIGN);
   }
-  OPENSSL_memset(powerbuf, 0, powerbufLen);
+  OPENSSL_memset(powerbuf, 0, powerbuf_len);
 
-  // lay down tmp and am right after powers table
-  tmp.d = powerbuf + top * numPowers;
+  // Place |tmp| and |am| right after powers table.
+  BIGNUM tmp, am;
+  tmp.d = powerbuf + top * num_powers;
   am.d = tmp.d + top;
   tmp.width = am.width = 0;
   tmp.dmax = am.dmax = top;
   tmp.neg = am.neg = 0;
   tmp.flags = am.flags = BN_FLG_STATIC_DATA;
 
-  if (!bn_one_to_montgomery(&tmp, mont, ctx)) {
+  if (!bn_one_to_montgomery(&tmp, mont, ctx) ||
+      !bn_resize_words(&tmp, top)) {
     goto err;
   }
 
-  // prepare a^1 in Montgomery domain
+  // Prepare a^1 in the Montgomery domain.
   assert(!a->neg);
   assert(BN_ucmp(a, m) < 0);
-  if (!BN_to_montgomery(&am, a, mont, ctx)) {
+  if (!BN_to_montgomery(&am, a, mont, ctx) ||
+      !bn_resize_words(&am, top)) {
     goto err;
   }
 
 #if defined(OPENSSL_BN_ASM_MONT5)
-  // This optimization uses ideas from http://eprint.iacr.org/2011/239,
-  // specifically optimization of cache-timing attack countermeasures
-  // and pre-computation optimization.
-
-  // Dedicated window==4 case improves 512-bit RSA sign by ~15%, but as
-  // 512-bit RSA is hardly relevant, we omit it to spare size...
+  // This optimization uses ideas from https://eprint.iacr.org/2011/239,
+  // specifically optimization of cache-timing attack countermeasures,
+  // pre-computation optimization, and Almost Montgomery Multiplication.
+  //
+  // The paper discusses a 4-bit window to optimize 512-bit modular
+  // exponentiation, used in RSA-1024 with CRT, but RSA-1024 is no longer
+  // important.
+  //
+  // |bn_mul_mont_gather5| and |bn_power5| implement the "almost" reduction
+  // variant, so the values here may not be fully reduced. They are bounded by R
+  // (i.e. they fit in |top| words), not |m|. Additionally, we pass these
+  // "almost" reduced inputs into |bn_mul_mont|, which implements the normal
+  // reduction variant. Given those inputs, |bn_mul_mont| may not give reduced
+  // output, but it will still produce "almost" reduced output.
+  //
+  // TODO(davidben): Using "almost" reduction complicates analysis of this code,
+  // and its interaction with other parts of the project. Determine whether this
+  // is actually necessary for performance.
   if (window == 5 && top > 1) {
-    const BN_ULONG *n0 = mont->n0;
-    BN_ULONG *np;
-
-    // BN_to_montgomery can contaminate words above .top
-    // [in BN_DEBUG[_DEBUG] build]...
-    for (i = am.width; i < top; i++) {
-      am.d[i] = 0;
-    }
-    for (i = tmp.width; i < top; i++) {
-      tmp.d[i] = 0;
-    }
-
-    // copy mont->N.d[] to improve cache locality
-    for (np = am.d + top, i = 0; i < top; i++) {
+    // Copy |mont->N| to improve cache locality.
+    BN_ULONG *np = am.d + top;
+    for (i = 0; i < top; i++) {
       np[i] = mont->N.d[i];
     }
 
+    // Fill |powerbuf| with the first 32 powers of |am|.
+    const BN_ULONG *n0 = mont->n0;
     bn_scatter5(tmp.d, top, powerbuf, 0);
     bn_scatter5(am.d, am.width, powerbuf, 1);
     bn_mul_mont(tmp.d, am.d, am.d, np, n0, top);
     bn_scatter5(tmp.d, top, powerbuf, 2);
 
-    // same as above, but uses squaring for 1/2 of operations
+    // Square to compute powers of two.
     for (i = 4; i < 32; i *= 2) {
       bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
       bn_scatter5(tmp.d, top, powerbuf, i);
     }
-    for (i = 3; i < 8; i += 2) {
-      int j;
+    // Compute odd powers |i| based on |i - 1|, then all powers |i * 2^j|.
+    for (i = 3; i < 32; i += 2) {
       bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
       bn_scatter5(tmp.d, top, powerbuf, i);
-      for (j = 2 * i; j < 32; j *= 2) {
+      for (int j = 2 * i; j < 32; j *= 2) {
         bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
         bn_scatter5(tmp.d, top, powerbuf, j);
       }
     }
-    for (; i < 16; i += 2) {
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
-      bn_scatter5(tmp.d, top, powerbuf, i);
-      bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
-      bn_scatter5(tmp.d, top, powerbuf, 2 * i);
-    }
-    for (; i < 32; i += 2) {
-      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
-      bn_scatter5(tmp.d, top, powerbuf, i);
-    }
 
     bits--;
     for (wvalue = 0, i = bits % 5; i >= 0; i--, bits--) {
@@ -1138,15 +1120,15 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
         bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, val);
       }
     }
-
-    ret = bn_from_montgomery(tmp.d, tmp.d, NULL, np, n0, top);
-    tmp.width = top;
-    if (ret) {
-      if (!BN_copy(rr, &tmp)) {
-        ret = 0;
-      }
-      goto err;  // non-zero ret means it's not error
-    }
+    // The result is now in |tmp| in Montgomery form, but it may not be fully
+    // reduced. This is within bounds for |BN_from_montgomery| (tmp < R <= m*R)
+    // so it will, when converting from Montgomery form, produce a fully reduced
+    // result.
+    //
+    // This differs from Figure 2 of the paper, which uses AMM(h, 1) to convert
+    // from Montgomery form with unreduced output, followed by an extra
+    // reduction step. In the paper's terminology, we replace steps 9 and 10
+    // with MM(h, 1).
   } else
 #endif
   {
@@ -1164,7 +1146,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
       copy_to_prebuf(&tmp, top, powerbuf, 2, window);
 
-      for (i = 3; i < numPowers; i++) {
+      for (i = 3; i < num_powers; i++) {
         // Calculate a^i = a^(i-1) * a
         if (!BN_mod_mul_montgomery(&tmp, &am, &tmp, mont, ctx)) {
           goto err;
@@ -1207,7 +1189,11 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     }
   }
 
-  // Convert the final result from montgomery to standard format
+  // Convert the final result from Montgomery to standard format. If we used the
+  // |OPENSSL_BN_ASM_MONT5| codepath, |tmp| may not be fully reduced. It is only
+  // bounded by R rather than |m|. However, that is still within bounds for
+  // |BN_from_montgomery|, which implements full Montgomery reduction, not
+  // "almost" Montgomery reduction.
   if (!BN_from_montgomery(rr, &tmp, mont, ctx)) {
     goto err;
   }
@@ -1215,11 +1201,11 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
 
 err:
   BN_MONT_CTX_free(new_mont);
-  if (powerbuf != NULL && powerbufFree == NULL) {
-    OPENSSL_cleanse(powerbuf, powerbufLen);
+  if (powerbuf != NULL && powerbuf_free == NULL) {
+    OPENSSL_cleanse(powerbuf, powerbuf_len);
   }
-  OPENSSL_free(powerbufFree);
-  return (ret);
+  OPENSSL_free(powerbuf_free);
+  return ret;
 }
 
 int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd.c

@@ -263,15 +263,14 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // Now  Y*a  ==  A  (mod |n|).
 
   // Y*a == 1  (mod |n|)
-  if (!Y->neg && BN_ucmp(Y, n) < 0) {
-    if (!BN_copy(R, Y)) {
-      goto err;
-    }
-  } else {
-    if (!BN_nnmod(R, Y, n, ctx)) {
+  if (Y->neg || BN_ucmp(Y, n) >= 0) {
+    if (!BN_nnmod(Y, Y, n, ctx)) {
       goto err;
     }
   }
+  if (!BN_copy(R, Y)) {
+    goto err;
+  }
 
   ret = 1;
 
@@ -286,7 +285,6 @@ BIGNUM *BN_mod_inverse(BIGNUM *out, const BIGNUM *a, const BIGNUM *n,
   if (out == NULL) {
     new_out = BN_new();
     if (new_out == NULL) {
-      OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE);
       return NULL;
     }
     out = new_out;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd_extra.c

@@ -240,8 +240,10 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
 
   // Each loop iteration halves at least one of |u| and |v|. Thus we need at
   // most the combined bit width of inputs for at least one value to be zero.
-  unsigned a_bits = a_width * BN_BITS2, n_bits = n_width * BN_BITS2;
-  unsigned num_iters = a_bits + n_bits;
+  // |a_bits| and |n_bits| cannot overflow because |bn_wexpand| ensures bit
+  // counts fit in even |int|.
+  size_t a_bits = a_width * BN_BITS2, n_bits = n_width * BN_BITS2;
+  size_t num_iters = a_bits + n_bits;
   if (num_iters < a_bits) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
     goto err;
@@ -260,7 +262,7 @@ int bn_mod_inverse_consttime(BIGNUM *r, int *out_no_inverse, const BIGNUM *a,
   //
   // After each loop iteration, u and v only get smaller, and at least one of
   // them shrinks by at least a factor of two.
-  for (unsigned i = 0; i < num_iters; i++) {
+  for (size_t i = 0; i < num_iters; i++) {
     BN_ULONG both_odd = word_is_odd_mask(u->d[0]) & word_is_odd_mask(v->d[0]);
 
     // If both |u| and |v| are odd, subtract the smaller from the larger.