commit a82f89181c90cbe8507b4d9d949c86ccf712b96d
author Hanno Becker <hanno.becker@arm.com> Mon Nov 06 15:08:27 2017 +0000
committer Hanno Becker <hanno.becker@arm.com> Mon Nov 06 15:08:27 2017 +0000
tree 331618c7d8e05a16ced7dc9fa1b0e785fdeb862e
parent 929359284347a3b006cd16d9df216abbebeec849

Verify result of RSA private key operation

library/bignum.c

diff --git a/library/bignum.c b/library/bignum.c
index 52edd3d..4f94e20 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -1609,7 +1609,7 @@
     mbedtls_mpi RR, T, W[ 2 << MBEDTLS_MPI_WINDOW_SIZE ], Apos;
     int neg;
 
-    if( mbedtls_mpi_cmp_int( N, 0 ) < 0 || ( N->p[0] & 1 ) == 0 )
+    if( mbedtls_mpi_cmp_int( N, 0 ) <= 0 || ( N->p[0] & 1 ) == 0 )
         return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
 
     if( mbedtls_mpi_cmp_int( E, 0 ) < 0 )

library/rsa.c

diff --git a/library/rsa.c b/library/rsa.c
index 40ea642..70d95fa 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -403,10 +403,17 @@
     mbedtls_mpi *DQ = &ctx->DQ;
 #endif
 
+    /* Temporaries holding the initial input and the double
+     * checked result; should be the same in the end. */
+    mbedtls_mpi I, C;
+
     /* Make sure we have private key info, prevent possible misuse */
     if( ctx->P.p == NULL || ctx->Q.p == NULL || ctx->D.p == NULL )
         return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
 
+    mbedtls_mpi_init( &I );
+    mbedtls_mpi_init( &C );
+
     mbedtls_mpi_init( &T ); mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 );
     mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 ); mbedtls_mpi_init( &R );
 
@@ -434,6 +441,8 @@
         goto cleanup;
     }
 
+    MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &I, &T ) );
+
     if( f_rng != NULL )
     {
         /*
@@ -522,6 +531,15 @@
         MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
     }
 
+    /* Verify the result to prevent glitching attacks. */
+    MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &C, &T, &ctx->E,
+                                          &ctx->N, &ctx->RN ) );
+    if( mbedtls_mpi_cmp_mpi( &C, &I ) != 0 )
+    {
+        ret = MBEDTLS_ERR_RSA_VERIFY_FAILED;
+        goto cleanup;
+    }
+
     olen = ctx->len;
     MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
 
@@ -544,6 +562,9 @@
 #endif
     }
 
+    mbedtls_mpi_free( &C );
+    mbedtls_mpi_free( &I );
+
     if( ret != 0 )
         return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );