mirror of
https://github.com/openssl/openssl.git
synced 2025-02-17 14:32:04 +08:00
dc55e4f70f
felem_neg does not produce an output within the tight bounds suitable for felem_contract. This affects build configurations which set enable-ec_nistp_64_gcc_128. point_double and point_add, in the non-z*_is_zero cases, tolerate and fix up the wider bounds, so this only affects point_add calls where the other point is infinity. Thus it only affects the final addition in arbitrary-point multiplication, giving the wrong y-coordinate. This is a no-op for ECDH and ECDSA, which only use the x-coordinate of arbitrary-point operations. Note: ecp_nistp521.c has the same issue in that the documented preconditions are violated by the test case. I have not addressed this in this PR. ecp_nistp521.c does not immediately produce the wrong answer; felem_contract there appears to be a bit more tolerant than its documented preconditions. However, I haven't checked the point_add property above holds. ecp_nistp521.c should either get this same fix, to be conservative, or have the bounds analysis and comments reworked for the wider bounds. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5779) |
||
|---|---|---|
| .. | ||
| aes | ||
| aria | ||
| asn1 | ||
| async | ||
| bf | ||
| bio | ||
| blake2 | ||
| bn | ||
| buffer | ||
| camellia | ||
| cast | ||
| chacha | ||
| cmac | ||
| cms | ||
| comp | ||
| conf | ||
| ct | ||
| des | ||
| dh | ||
| dsa | ||
| dso | ||
| ec | ||
| engine | ||
| err | ||
| evp | ||
| hmac | ||
| idea | ||
| include/internal | ||
| kdf | ||
| lhash | ||
| md2 | ||
| md4 | ||
| md5 | ||
| mdc2 | ||
| modes | ||
| objects | ||
| ocsp | ||
| pem | ||
| perlasm | ||
| pkcs7 | ||
| pkcs12 | ||
| poly1305 | ||
| rand | ||
| rc2 | ||
| rc4 | ||
| rc5 | ||
| ripemd | ||
| rsa | ||
| seed | ||
| sha | ||
| siphash | ||
| sm2 | ||
| sm3 | ||
| sm4 | ||
| srp | ||
| stack | ||
| store | ||
| ts | ||
| txt_db | ||
| ui | ||
| whrlpool | ||
| x509 | ||
| x509v3 | ||
| alphacpuid.pl | ||
| arm64cpuid.pl | ||
| arm_arch.h | ||
| armcap.c | ||
| armv4cpuid.pl | ||
| build.info | ||
| c64xpluscpuid.pl | ||
| cpt_err.c | ||
| cryptlib.c | ||
| ctype.c | ||
| cversion.c | ||
| dllmain.c | ||
| ebcdic.c | ||
| ex_data.c | ||
| ia64cpuid.S | ||
| init.c | ||
| LPdir_nyi.c | ||
| LPdir_unix.c | ||
| LPdir_vms.c | ||
| LPdir_win32.c | ||
| LPdir_win.c | ||
| LPdir_wince.c | ||
| mem_clr.c | ||
| mem_dbg.c | ||
| mem_sec.c | ||
| mem.c | ||
| mips_arch.h | ||
| o_dir.c | ||
| o_fips.c | ||
| o_fopen.c | ||
| o_init.c | ||
| o_str.c | ||
| o_time.c | ||
| pariscid.pl | ||
| ppc_arch.h | ||
| ppccap.c | ||
| ppccpuid.pl | ||
| s390x_arch.h | ||
| s390xcap.c | ||
| s390xcpuid.pl | ||
| sparc_arch.h | ||
| sparccpuid.S | ||
| sparcv9cap.c | ||
| threads_none.c | ||
| threads_pthread.c | ||
| threads_win.c | ||
| uid.c | ||
| vms_rms.h | ||
| x86_64cpuid.pl | ||
| x86cpuid.pl | ||