grpc 1.53.1 → 1.57.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec_key.c

@@ -79,6 +79,7 @@
 
 #include "internal.h"
 #include "../delocate.h"
+#include "../service_indicator/internal.h"
 #include "../../internal.h"
 
 
@@ -87,14 +88,13 @@ DEFINE_STATIC_EX_DATA_CLASS(g_ec_ex_data_class)
 static EC_WRAPPED_SCALAR *ec_wrapped_scalar_new(const EC_GROUP *group) {
   EC_WRAPPED_SCALAR *wrapped = OPENSSL_malloc(sizeof(EC_WRAPPED_SCALAR));
   if (wrapped == NULL) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_MALLOC_FAILURE);
     return NULL;
   }
 
   OPENSSL_memset(wrapped, 0, sizeof(EC_WRAPPED_SCALAR));
   wrapped->bignum.d = wrapped->scalar.words;
-  wrapped->bignum.width = group->order.width;
-  wrapped->bignum.dmax = group->order.width;
+  wrapped->bignum.width = group->order.N.width;
+  wrapped->bignum.dmax = group->order.N.width;
   wrapped->bignum.flags = BN_FLG_STATIC_DATA;
   return wrapped;
 }
@@ -108,7 +108,6 @@ EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); }
 EC_KEY *EC_KEY_new_method(const ENGINE *engine) {
   EC_KEY *ret = OPENSSL_malloc(sizeof(EC_KEY));
   if (ret == NULL) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_MALLOC_FAILURE);
     return NULL;
   }
 
@@ -141,7 +140,6 @@ EC_KEY *EC_KEY_new_method(const ENGINE *engine) {
 EC_KEY *EC_KEY_new_by_curve_name(int nid) {
   EC_KEY *ret = EC_KEY_new();
   if (ret == NULL) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_MALLOC_FAILURE);
     return NULL;
   }
   ret->group = EC_GROUP_new_by_curve_name(nid);
@@ -246,8 +244,9 @@ int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) {
   if (scalar == NULL) {
     return 0;
   }
-  if (!ec_bignum_to_scalar(key->group, &scalar->scalar, priv_key)) {
-    OPENSSL_PUT_ERROR(EC, EC_R_WRONG_ORDER);
+  if (!ec_bignum_to_scalar(key->group, &scalar->scalar, priv_key) ||
+      ec_scalar_is_zero(key->group, &scalar->scalar)) {
+    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY);
     ec_wrapped_scalar_free(scalar);
     return 0;
   }
@@ -308,8 +307,11 @@ int EC_KEY_check_key(const EC_KEY *eckey) {
   }
 
   // Check the public and private keys match.
+  //
+  // NOTE: this is a FIPS pair-wise consistency check for the ECDH case. See SP
+  // 800-56Ar3, page 36.
   if (eckey->priv_key != NULL) {
-    EC_RAW_POINT point;
+    EC_JACOBIAN point;
     if (!ec_point_mul_scalar_base(eckey->group, &point,
                                   &eckey->priv_key->scalar)) {
       OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB);
@@ -326,32 +328,43 @@ int EC_KEY_check_key(const EC_KEY *eckey) {
 }
 
 int EC_KEY_check_fips(const EC_KEY *key) {
+  int ret = 0;
+  FIPS_service_indicator_lock_state();
+
   if (EC_KEY_is_opaque(key)) {
     // Opaque keys can't be checked.
     OPENSSL_PUT_ERROR(EC, EC_R_PUBLIC_KEY_VALIDATION_FAILED);
-    return 0;
+    goto end;
   }
 
   if (!EC_KEY_check_key(key)) {
-    return 0;
+    goto end;
   }
 
   if (key->priv_key) {
     uint8_t data[16] = {0};
     ECDSA_SIG *sig = ECDSA_do_sign(data, sizeof(data), key);
-#if defined(BORINGSSL_FIPS_BREAK_ECDSA_PWCT)
-    data[0] = ~data[0];
-#endif
+    if (boringssl_fips_break_test("ECDSA_PWCT")) {
+      data[0] = ~data[0];
+    }
     int ok = sig != NULL &&
              ECDSA_do_verify(data, sizeof(data), sig, key);
     ECDSA_SIG_free(sig);
     if (!ok) {
       OPENSSL_PUT_ERROR(EC, EC_R_PUBLIC_KEY_VALIDATION_FAILED);
-      return 0;
+      goto end;
     }
   }
 
-  return 1;
+  ret = 1;
+
+end:
+  FIPS_service_indicator_unlock_state();
+  if (ret) {
+    EC_KEY_keygen_verify_service_indicator(key);
+  }
+
+  return ret;
 }
 
 int EC_KEY_set_public_key_affine_coordinates(EC_KEY *key, const BIGNUM *x,
@@ -379,14 +392,73 @@ err:
   return ok;
 }
 
+int EC_KEY_oct2key(EC_KEY *key, const uint8_t *in, size_t len, BN_CTX *ctx) {
+  if (key->group == NULL) {
+    OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
+    return 0;
+  }
+
+  EC_POINT *point = EC_POINT_new(key->group);
+  int ok = point != NULL &&
+           EC_POINT_oct2point(key->group, point, in, len, ctx) &&
+           EC_KEY_set_public_key(key, point);
+  EC_POINT_free(point);
+  return ok;
+}
+
 size_t EC_KEY_key2buf(const EC_KEY *key, point_conversion_form_t form,
-                      unsigned char **out_buf, BN_CTX *ctx) {
+                      uint8_t **out_buf, BN_CTX *ctx) {
   if (key == NULL || key->pub_key == NULL || key->group == NULL) {
+    OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
     return 0;
   }
 
-  const size_t len =
-      EC_POINT_point2oct(key->group, key->pub_key, form, NULL, 0, ctx);
+  return EC_POINT_point2buf(key->group, key->pub_key, form, out_buf, ctx);
+}
+
+int EC_KEY_oct2priv(EC_KEY *key, const uint8_t *in, size_t len) {
+  if (key->group == NULL) {
+    OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
+    return 0;
+  }
+
+  if (len != BN_num_bytes(EC_GROUP_get0_order(key->group))) {
+    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
+    return 0;
+  }
+
+  BIGNUM *priv_key = BN_bin2bn(in, len, NULL);
+  int ok = priv_key != NULL &&  //
+           EC_KEY_set_private_key(key, priv_key);
+  BN_free(priv_key);
+  return ok;
+}
+
+size_t EC_KEY_priv2oct(const EC_KEY *key, uint8_t *out, size_t max_out) {
+  if (key->group == NULL || key->priv_key == NULL) {
+    OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
+    return 0;
+  }
+
+  size_t len = BN_num_bytes(EC_GROUP_get0_order(key->group));
+  if (out == NULL) {
+    return len;
+  }
+
+  if (max_out < len) {
+    OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
+    return 0;
+  }
+
+  size_t bytes_written;
+  ec_scalar_to_bytes(key->group, out, &bytes_written, &key->priv_key->scalar);
+  assert(bytes_written == len);
+  return len;
+}
+
+size_t EC_KEY_priv2buf(const EC_KEY *key, uint8_t **out_buf) {
+  *out_buf = NULL;
+  size_t len = EC_KEY_priv2oct(key, NULL, 0);
   if (len == 0) {
     return 0;
   }
@@ -396,8 +468,8 @@ size_t EC_KEY_key2buf(const EC_KEY *key, point_conversion_form_t form,
     return 0;
   }
 
-  if (EC_POINT_point2oct(key->group, key->pub_key, form, buf, len, ctx) !=
-      len) {
+  len = EC_KEY_priv2oct(key, buf, len);
+  if (len == 0) {
     OPENSSL_free(buf);
     return 0;
   }
@@ -413,7 +485,7 @@ int EC_KEY_generate_key(EC_KEY *key) {
   }
 
   // Check that the group order is FIPS compliant (FIPS 186-4 B.4.2).
-  if (BN_num_bits(EC_GROUP_get0_order(key->group)) < 160) {
+  if (EC_GROUP_order_bits(key->group) < 160) {
     OPENSSL_PUT_ERROR(EC, EC_R_INVALID_GROUP_ORDER);
     return 0;
   }
@@ -439,6 +511,8 @@ int EC_KEY_generate_key(EC_KEY *key) {
 }
 
 int EC_KEY_generate_key_fips(EC_KEY *eckey) {
+  boringssl_ensure_ecc_self_test();
+
   if (EC_KEY_generate_key(eckey) && EC_KEY_check_fips(eckey)) {
     return 1;
   }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec_montgomery.c

@@ -76,67 +76,35 @@
 #include "internal.h"
 
 
-int ec_GFp_mont_group_init(EC_GROUP *group) {
-  int ok;
-
-  ok = ec_GFp_simple_group_init(group);
-  group->mont = NULL;
-  return ok;
-}
-
-void ec_GFp_mont_group_finish(EC_GROUP *group) {
-  BN_MONT_CTX_free(group->mont);
-  group->mont = NULL;
-  ec_GFp_simple_group_finish(group);
-}
-
-int ec_GFp_mont_group_set_curve(EC_GROUP *group, const BIGNUM *p,
-                                const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
-  BN_MONT_CTX_free(group->mont);
-  group->mont = BN_MONT_CTX_new_for_modulus(p, ctx);
-  if (group->mont == NULL) {
-    OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB);
-    return 0;
-  }
-
-  if (!ec_GFp_simple_group_set_curve(group, p, a, b, ctx)) {
-    BN_MONT_CTX_free(group->mont);
-    group->mont = NULL;
-    return 0;
-  }
-
-  return 1;
-}
-
 static void ec_GFp_mont_felem_to_montgomery(const EC_GROUP *group,
                                             EC_FELEM *out, const EC_FELEM *in) {
-  bn_to_montgomery_small(out->words, in->words, group->field.width,
-                         group->mont);
+  bn_to_montgomery_small(out->words, in->words, group->field.N.width,
+                         &group->field);
 }
 
 static void ec_GFp_mont_felem_from_montgomery(const EC_GROUP *group,
                                               EC_FELEM *out,
                                               const EC_FELEM *in) {
-  bn_from_montgomery_small(out->words, group->field.width, in->words,
-                           group->field.width, group->mont);
+  bn_from_montgomery_small(out->words, group->field.N.width, in->words,
+                           group->field.N.width, &group->field);
 }
 
 static void ec_GFp_mont_felem_inv0(const EC_GROUP *group, EC_FELEM *out,
                                    const EC_FELEM *a) {
-  bn_mod_inverse0_prime_mont_small(out->words, a->words, group->field.width,
-                                   group->mont);
+  bn_mod_inverse0_prime_mont_small(out->words, a->words, group->field.N.width,
+                                   &group->field);
 }
 
 void ec_GFp_mont_felem_mul(const EC_GROUP *group, EC_FELEM *r,
                            const EC_FELEM *a, const EC_FELEM *b) {
-  bn_mod_mul_montgomery_small(r->words, a->words, b->words, group->field.width,
-                              group->mont);
+  bn_mod_mul_montgomery_small(r->words, a->words, b->words,
+                              group->field.N.width, &group->field);
 }
 
 void ec_GFp_mont_felem_sqr(const EC_GROUP *group, EC_FELEM *r,
                            const EC_FELEM *a) {
-  bn_mod_mul_montgomery_small(r->words, a->words, a->words, group->field.width,
-                              group->mont);
+  bn_mod_mul_montgomery_small(r->words, a->words, a->words,
+                              group->field.N.width, &group->field);
 }
 
 void ec_GFp_mont_felem_to_bytes(const EC_GROUP *group, uint8_t *out,
@@ -156,28 +124,29 @@ int ec_GFp_mont_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out,
   return 1;
 }
 
-static void ec_GFp_mont_felem_reduce(const EC_GROUP *group, EC_FELEM *out,
-                                     const BN_ULONG *words, size_t num) {
+void ec_GFp_mont_felem_reduce(const EC_GROUP *group, EC_FELEM *out,
+                              const BN_ULONG *words, size_t num) {
   // Convert "from" Montgomery form so the value is reduced mod p.
-  bn_from_montgomery_small(out->words, group->field.width, words, num,
-                           group->mont);
+  bn_from_montgomery_small(out->words, group->field.N.width, words, num,
+                           &group->field);
   // Convert "to" Montgomery form to remove the R^-1 factor added.
   ec_GFp_mont_felem_to_montgomery(group, out, out);
   // Convert to Montgomery form to match this implementation's representation.
   ec_GFp_mont_felem_to_montgomery(group, out, out);
 }
 
-static void ec_GFp_mont_felem_exp(const EC_GROUP *group, EC_FELEM *out,
-                                  const EC_FELEM *a, const BN_ULONG *exp,
-                                  size_t num_exp) {
-  bn_mod_exp_mont_small(out->words, a->words, group->field.width, exp, num_exp,
-                        group->mont);
+void ec_GFp_mont_felem_exp(const EC_GROUP *group, EC_FELEM *out,
+                           const EC_FELEM *a, const BN_ULONG *exp,
+                           size_t num_exp) {
+  bn_mod_exp_mont_small(out->words, a->words, group->field.N.width, exp,
+                        num_exp, &group->field);
 }
 
 static int ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP *group,
-                                                    const EC_RAW_POINT *point,
+                                                    const EC_JACOBIAN *point,
                                                     EC_FELEM *x, EC_FELEM *y) {
-  if (ec_GFp_simple_is_at_infinity(group, point)) {
+  if (constant_time_declassify_int(
+          ec_GFp_simple_is_at_infinity(group, point))) {
     OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
     return 0;
   }
@@ -202,7 +171,7 @@ static int ec_GFp_mont_point_get_affine_coordinates(const EC_GROUP *group,
 
 static int ec_GFp_mont_jacobian_to_affine_batch(const EC_GROUP *group,
                                                 EC_AFFINE *out,
-                                                const EC_RAW_POINT *in,
+                                                const EC_JACOBIAN *in,
                                                 size_t num) {
   if (num == 0) {
     return 1;
@@ -246,8 +215,8 @@ static int ec_GFp_mont_jacobian_to_affine_batch(const EC_GROUP *group,
   return 1;
 }
 
-void ec_GFp_mont_add(const EC_GROUP *group, EC_RAW_POINT *out,
-                     const EC_RAW_POINT *a, const EC_RAW_POINT *b) {
+void ec_GFp_mont_add(const EC_GROUP *group, EC_JACOBIAN *out,
+                     const EC_JACOBIAN *a, const EC_JACOBIAN *b) {
   if (a == b) {
     ec_GFp_mont_dbl(group, out, a);
     return;
@@ -317,7 +286,7 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_RAW_POINT *out,
 
   // This case will never occur in the constant-time |ec_GFp_mont_mul|.
   BN_ULONG is_nontrivial_double = ~xneq & ~yneq & z1nz & z2nz;
-  if (is_nontrivial_double) {
+  if (constant_time_declassify_w(is_nontrivial_double)) {
     ec_GFp_mont_dbl(group, out, a);
     return;
   }
@@ -357,8 +326,8 @@ void ec_GFp_mont_add(const EC_GROUP *group, EC_RAW_POINT *out,
   ec_felem_select(group, &out->Z, z2nz, &z_out, &a->Z);
 }
 
-void ec_GFp_mont_dbl(const EC_GROUP *group, EC_RAW_POINT *r,
-                     const EC_RAW_POINT *a) {
+void ec_GFp_mont_dbl(const EC_GROUP *group, EC_JACOBIAN *r,
+                     const EC_JACOBIAN *a) {
   if (group->a_is_minus3) {
     // The method is taken from:
     //   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
@@ -453,10 +422,10 @@ void ec_GFp_mont_dbl(const EC_GROUP *group, EC_RAW_POINT *r,
 }
 
 static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
-                                        const EC_RAW_POINT *p,
+                                        const EC_JACOBIAN *p,
                                         const EC_SCALAR *r) {
   if (!group->field_greater_than_order ||
-      group->field.width != group->order.width) {
+      group->field.N.width != group->order.N.width) {
     // Do not bother optimizing this case. p > order in all commonly-used
     // curves.
     return ec_GFp_simple_cmp_x_coordinate(group, p, r);
@@ -472,7 +441,7 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
   EC_FELEM r_Z2, Z2_mont, X;
   ec_GFp_mont_felem_mul(group, &Z2_mont, &p->Z, &p->Z);
   // r < order < p, so this is valid.
-  OPENSSL_memcpy(r_Z2.words, r->words, group->field.width * sizeof(BN_ULONG));
+  OPENSSL_memcpy(r_Z2.words, r->words, group->field.N.width * sizeof(BN_ULONG));
   ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
   ec_GFp_mont_felem_from_montgomery(group, &X, &p->X);
 
@@ -484,10 +453,11 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
   // Therefore there is a small possibility, less than 1/2^128, that group_order
   // < p.x < P. in that case we need not only to compare against |r| but also to
   // compare against r+group_order.
-  if (bn_less_than_words(r->words, group->field_minus_order.words,
-                         group->field.width)) {
-    // We can ignore the carry because: r + group_order < p < 2^256.
-    bn_add_words(r_Z2.words, r->words, group->order.d, group->field.width);
+  BN_ULONG carry = bn_add_words(r_Z2.words, r->words, group->order.N.d,
+                                group->field.N.width);
+  if (carry == 0 &&
+      bn_less_than_words(r_Z2.words, group->field.N.d, group->field.N.width)) {
+    // r + group_order < p, so compare (r + group_order) * Z^2 against X.
     ec_GFp_mont_felem_mul(group, &r_Z2, &r_Z2, &Z2_mont);
     if (ec_felem_equal(group, &r_Z2, &X)) {
       return 1;
@@ -498,9 +468,6 @@ static int ec_GFp_mont_cmp_x_coordinate(const EC_GROUP *group,
 }
 
 DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) {
-  out->group_init = ec_GFp_mont_group_init;
-  out->group_finish = ec_GFp_mont_group_finish;
-  out->group_set_curve = ec_GFp_mont_group_set_curve;
   out->point_get_affine_coordinates = ec_GFp_mont_point_get_affine_coordinates;
   out->jacobian_to_affine_batch = ec_GFp_mont_jacobian_to_affine_batch;
   out->add = ec_GFp_mont_add;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/felem.c

@@ -23,12 +23,16 @@
 #include "../../internal.h"
 
 
+const EC_FELEM *ec_felem_one(const EC_GROUP *group) {
+  // We reuse generator.Z as a cache for 1 in the field.
+  return &group->generator.raw.Z;
+}
+
 int ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out, const BIGNUM *in) {
   uint8_t bytes[EC_MAX_BYTES];
-  size_t len = BN_num_bytes(&group->field);
+  size_t len = BN_num_bytes(&group->field.N);
   assert(sizeof(bytes) >= len);
-  if (BN_is_negative(in) ||
-      BN_cmp(in, &group->field) >= 0 ||
+  if (BN_is_negative(in) || BN_cmp(in, &group->field.N) >= 0 ||
       !BN_bn2bin_padded(bytes, len, in)) {
     OPENSSL_PUT_ERROR(EC, EC_R_COORDINATES_OUT_OF_RANGE);
     return 0;
@@ -57,11 +61,11 @@ int ec_felem_from_bytes(const EC_GROUP *group, EC_FELEM *out, const uint8_t *in,
 void ec_felem_neg(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a) {
   // -a is zero if a is zero and p-a otherwise.
   BN_ULONG mask = ec_felem_non_zero_mask(group, a);
-  BN_ULONG borrow =
-      bn_sub_words(out->words, group->field.d, a->words, group->field.width);
+  BN_ULONG borrow = bn_sub_words(out->words, group->field.N.d, a->words,
+                                 group->field.N.width);
   assert(borrow == 0);
   (void)borrow;
-  for (int i = 0; i < group->field.width; i++) {
+  for (int i = 0; i < group->field.N.width; i++) {
     out->words[i] &= mask;
   }
 }
@@ -69,20 +73,20 @@ void ec_felem_neg(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a) {
 void ec_felem_add(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
                   const EC_FELEM *b) {
   EC_FELEM tmp;
-  bn_mod_add_words(out->words, a->words, b->words, group->field.d, tmp.words,
-                   group->field.width);
+  bn_mod_add_words(out->words, a->words, b->words, group->field.N.d, tmp.words,
+                   group->field.N.width);
 }
 
 void ec_felem_sub(const EC_GROUP *group, EC_FELEM *out, const EC_FELEM *a,
                   const EC_FELEM *b) {
   EC_FELEM tmp;
-  bn_mod_sub_words(out->words, a->words, b->words, group->field.d, tmp.words,
-                   group->field.width);
+  bn_mod_sub_words(out->words, a->words, b->words, group->field.N.d, tmp.words,
+                   group->field.N.width);
 }
 
 BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) {
   BN_ULONG mask = 0;
-  for (int i = 0; i < group->field.width; i++) {
+  for (int i = 0; i < group->field.N.width; i++) {
     mask |= a->words[i];
   }
   return ~constant_time_is_zero_w(mask);
@@ -90,11 +94,11 @@ BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) {
 
 void ec_felem_select(const EC_GROUP *group, EC_FELEM *out, BN_ULONG mask,
                      const EC_FELEM *a, const EC_FELEM *b) {
-  bn_select_words(out->words, mask, a->words, b->words, group->field.width);
+  bn_select_words(out->words, mask, a->words, b->words, group->field.N.width);
 }
 
 int ec_felem_equal(const EC_GROUP *group, const EC_FELEM *a,
                    const EC_FELEM *b) {
   return CRYPTO_memcmp(a->words, b->words,
-                       group->field.width * sizeof(BN_ULONG)) == 0;
+                       group->field.N.width * sizeof(BN_ULONG)) == 0;
 }