Skip to content

Commit a492d56

Browse files
author
tb
committed
Make the bn_rand_interval() API a bit more ergonomic
Provide bn_rand_in_range() which is a slightly tweaked version of what was previously called bn_rand_range(). The way bn_rand_range() is called in libcrypto, the lower bound is always expressible as a word. In fact, most of the time it is 1, the DH code uses a 2, the MR tests in BPSW use 3 and an exceptinally high number appears in the Tonelli-Shanks implementation where we use 32. Converting these lower bounds to BIGNUMs on the call site is annoying so let bn_rand_interval() do that internally and route that through bn_rand_in_range(). This way we can avoid using BN_sub_word(). Adjust the bn_isqrt() test to use bn_rand_in_range() since that's the only caller that uses actual BIGNUMs as lower bounds. ok jsing
1 parent b3199c6 commit a492d56

File tree

11 files changed

+57
-52
lines changed

11 files changed

+57
-52
lines changed

‎src/lib/libcrypto/bn/bn_bpsw.c

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: bn_bpsw.c,v 1.10 2023/05/10 21:05:24 tb Exp $ */
1+
/* $OpenBSD: bn_bpsw.c,v 1.11 2023/08/03 18:53:55 tb Exp $ */
22
/*
33
* Copyright (c) 2022 Martin Grenouilloux <martin.grenouilloux@lse.epita.fr>
44
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -385,7 +385,7 @@ bn_miller_rabin(int *is_pseudoprime, const BIGNUM *n, BN_CTX *ctx,
385385
size_t rounds)
386386
{
387387
BN_MONT_CTX *mctx = NULL;
388-
BIGNUM *base, *k, *n_minus_one, *three;
388+
BIGNUM *base, *k, *n_minus_one;
389389
size_t i;
390390
int s;
391391
int ret = 0;
@@ -398,8 +398,6 @@ bn_miller_rabin(int *is_pseudoprime, const BIGNUM *n, BN_CTX *ctx,
398398
goto err;
399399
if ((n_minus_one = BN_CTX_get(ctx)) == NULL)
400400
goto err;
401-
if ((three = BN_CTX_get(ctx)) == NULL)
402-
goto err;
403401

404402
if (BN_is_word(n, 2) || BN_is_word(n, 3)) {
405403
*is_pseudoprime = 1;
@@ -451,11 +449,8 @@ bn_miller_rabin(int *is_pseudoprime, const BIGNUM *n, BN_CTX *ctx,
451449
* risk of false positives in BPSW.
452450
*/
453451

454-
if (!BN_set_word(three, 3))
455-
goto err;
456-
457452
for (i = 0; i < rounds; i++) {
458-
if (!bn_rand_interval(base, three, n_minus_one))
453+
if (!bn_rand_interval(base, 3, n_minus_one))
459454
goto err;
460455

461456
if (!bn_fermat(is_pseudoprime, n, n_minus_one, k, s, base, ctx,

‎src/lib/libcrypto/bn/bn_local.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: bn_local.h,v 1.32 2023/08/02 08:44:38 tb Exp $ */
1+
/* $OpenBSD: bn_local.h,v 1.33 2023/08/03 18:53:55 tb Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -274,7 +274,8 @@ void bn_div_rem_words(BN_ULONG h, BN_ULONG l, BN_ULONG d, BN_ULONG *out_q,
274274
BN_ULONG *out_r);
275275

276276
int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom);
277-
int bn_rand_interval(BIGNUM *rnd, const BIGNUM *lower_inc, const BIGNUM *upper_exc);
277+
int bn_rand_in_range(BIGNUM *rnd, const BIGNUM *lower_inc, const BIGNUM *upper_exc);
278+
int bn_rand_interval(BIGNUM *rnd, BN_ULONG lower_word, const BIGNUM *upper_exc);
278279

279280
void BN_init(BIGNUM *);
280281

‎src/lib/libcrypto/bn/bn_mod_sqrt.c

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: bn_mod_sqrt.c,v 1.2 2023/07/08 12:21:58 beck Exp $ */
1+
/* $OpenBSD: bn_mod_sqrt.c,v 1.3 2023/08/03 18:53:55 tb Exp $ */
22

33
/*
44
* Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -237,16 +237,14 @@ static int
237237
bn_mod_sqrt_find_sylow_generator(BIGNUM *out_generator, const BIGNUM *p,
238238
const BIGNUM *q, BN_CTX *ctx)
239239
{
240-
BIGNUM *n, *p_abs, *thirty_two;
240+
BIGNUM *n, *p_abs;
241241
int i, is_non_residue;
242242
int ret = 0;
243243

244244
BN_CTX_start(ctx);
245245

246246
if ((n = BN_CTX_get(ctx)) == NULL)
247247
goto err;
248-
if ((thirty_two = BN_CTX_get(ctx)) == NULL)
249-
goto err;
250248
if ((p_abs = BN_CTX_get(ctx)) == NULL)
251249
goto err;
252250

@@ -259,14 +257,12 @@ bn_mod_sqrt_find_sylow_generator(BIGNUM *out_generator, const BIGNUM *p,
259257
goto found;
260258
}
261259

262-
if (!BN_set_word(thirty_two, 32))
263-
goto err;
264260
if (!bn_copy(p_abs, p))
265261
goto err;
266262
BN_set_negative(p_abs, 0);
267263

268264
for (i = 0; i < 128; i++) {
269-
if (!bn_rand_interval(n, thirty_two, p_abs))
265+
if (!bn_rand_interval(n, 32, p_abs))
270266
goto err;
271267
if (!bn_mod_sqrt_n_is_non_residue(&is_non_residue, n, p, ctx))
272268
goto err;

‎src/lib/libcrypto/bn/bn_rand.c

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: bn_rand.c,v 1.28 2023/07/08 12:21:58 beck Exp $ */
1+
/* $OpenBSD: bn_rand.c,v 1.29 2023/08/03 18:53:55 tb Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -284,29 +284,46 @@ BN_rand_range(BIGNUM *r, const BIGNUM *range)
284284
LCRYPTO_ALIAS(BN_rand_range);
285285

286286
int
287-
bn_rand_interval(BIGNUM *rnd, const BIGNUM *lower_inc, const BIGNUM *upper_exc)
287+
bn_rand_in_range(BIGNUM *rnd, const BIGNUM *lower_inc, const BIGNUM *upper_exc)
288288
{
289-
BIGNUM *len = NULL;
289+
BIGNUM *len;
290290
int ret = 0;
291291

292-
if (BN_cmp(lower_inc, upper_exc) >= 0)
293-
goto err;
294-
295292
if ((len = BN_new()) == NULL)
296293
goto err;
297-
298294
if (!BN_sub(len, upper_exc, lower_inc))
299295
goto err;
300-
301-
if (!bn_rand_range(0, rnd, len))
296+
if (!BN_rand_range(rnd, len))
302297
goto err;
303-
304298
if (!BN_add(rnd, rnd, lower_inc))
305299
goto err;
306300

307301
ret = 1;
302+
308303
err:
309304
BN_free(len);
305+
306+
return ret;
307+
}
308+
309+
int
310+
bn_rand_interval(BIGNUM *rnd, BN_ULONG lower_word, const BIGNUM *upper_exc)
311+
{
312+
BIGNUM *lower_inc = NULL;
313+
int ret = 0;
314+
315+
if ((lower_inc = BN_new()) == NULL)
316+
goto err;
317+
if (!BN_set_word(lower_inc, lower_word))
318+
goto err;
319+
if (!bn_rand_in_range(rnd, lower_inc, upper_exc))
320+
goto err;
321+
322+
ret = 1;
323+
324+
err:
325+
BN_free(lower_inc);
326+
310327
return ret;
311328
}
312329

‎src/lib/libcrypto/dh/dh_key.c

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: dh_key.c,v 1.39 2023/07/08 15:29:03 beck Exp $ */
1+
/* $OpenBSD: dh_key.c,v 1.40 2023/08/03 18:53:55 tb Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -109,7 +109,7 @@ generate_key(DH *dh)
109109
unsigned l;
110110
BN_CTX *ctx;
111111
BN_MONT_CTX *mont = NULL;
112-
BIGNUM *pub_key = NULL, *priv_key = NULL, *two = NULL;
112+
BIGNUM *pub_key = NULL, *priv_key = NULL;
113113

114114
if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
115115
DHerror(DH_R_MODULUS_TOO_LARGE);
@@ -139,11 +139,7 @@ generate_key(DH *dh)
139139

140140
if (dh->priv_key == NULL) {
141141
if (dh->q) {
142-
if ((two = BN_new()) == NULL)
143-
goto err;
144-
if (!BN_add(two, BN_value_one(), BN_value_one()))
145-
goto err;
146-
if (!bn_rand_interval(priv_key, two, dh->q))
142+
if (!bn_rand_interval(priv_key, 2, dh->q))
147143
goto err;
148144
} else {
149145
/* secret exponent length */
@@ -169,7 +165,7 @@ generate_key(DH *dh)
169165
if (dh->priv_key == NULL)
170166
BN_free(priv_key);
171167
BN_CTX_free(ctx);
172-
BN_free(two);
168+
173169
return ok;
174170
}
175171

‎src/lib/libcrypto/dsa/dsa_key.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: dsa_key.c,v 1.34 2023/07/08 14:28:15 beck Exp $ */
1+
/* $OpenBSD: dsa_key.c,v 1.35 2023/08/03 18:53:55 tb Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -95,7 +95,7 @@ dsa_builtin_keygen(DSA *dsa)
9595
if ((ctx = BN_CTX_new()) == NULL)
9696
goto err;
9797

98-
if (!bn_rand_interval(priv_key, BN_value_one(), dsa->q))
98+
if (!bn_rand_interval(priv_key, 1, dsa->q))
9999
goto err;
100100
if (!BN_mod_exp_ct(pub_key, dsa->g, priv_key, dsa->p, ctx))
101101
goto err;

‎src/lib/libcrypto/dsa/dsa_ossl.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: dsa_ossl.c,v 1.52 2023/07/08 14:28:15 beck Exp $ */
1+
/* $OpenBSD: dsa_ossl.c,v 1.53 2023/08/03 18:53:55 tb Exp $ */
22
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
33
* All rights reserved.
44
*
@@ -172,7 +172,7 @@ dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
172172
*
173173
* Where b is a random value in the range [1, q).
174174
*/
175-
if (!bn_rand_interval(b, BN_value_one(), dsa->q))
175+
if (!bn_rand_interval(b, 1, dsa->q))
176176
goto err;
177177
if (BN_mod_inverse_ct(binv, b, dsa->q, ctx) == NULL)
178178
goto err;
@@ -261,7 +261,7 @@ dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
261261
!BN_set_bit(m, q_bits))
262262
goto err;
263263

264-
if (!bn_rand_interval(k, BN_value_one(), dsa->q))
264+
if (!bn_rand_interval(k, 1, dsa->q))
265265
goto err;
266266

267267
BN_set_flags(k, BN_FLG_CONSTTIME);

‎src/lib/libcrypto/ec/ec_key.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: ec_key.c,v 1.36 2023/07/07 13:54:45 beck Exp $ */
1+
/* $OpenBSD: ec_key.c,v 1.37 2023/08/03 18:53:56 tb Exp $ */
22
/*
33
* Written by Nils Larsch for the OpenSSL project.
44
*/
@@ -269,7 +269,7 @@ ec_key_gen(EC_KEY *eckey)
269269

270270
if ((order = EC_GROUP_get0_order(eckey->group)) == NULL)
271271
goto err;
272-
if (!bn_rand_interval(priv_key, BN_value_one(), order))
272+
if (!bn_rand_interval(priv_key, 1, order))
273273
goto err;
274274
if (!EC_POINT_mul(eckey->group, pub_key, priv_key, NULL, NULL, NULL))
275275
goto err;

‎src/lib/libcrypto/ec/ecp_smpl.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: ecp_smpl.c,v 1.55 2023/07/26 17:15:25 tb Exp $ */
1+
/* $OpenBSD: ecp_smpl.c,v 1.56 2023/08/03 18:53:56 tb Exp $ */
22
/* Includes code written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
33
* for the OpenSSL project.
44
* Includes code written by Bodo Moeller for the OpenSSL project.
@@ -1227,7 +1227,7 @@ ec_GFp_simple_blind_coordinates(const EC_GROUP *group, EC_POINT *p, BN_CTX *ctx)
12271227
goto err;
12281228

12291229
/* Generate lambda in [1, group->field). */
1230-
if (!bn_rand_interval(lambda, BN_value_one(), &group->field))
1230+
if (!bn_rand_interval(lambda, 1, &group->field))
12311231
goto err;
12321232

12331233
if (group->meth->field_encode != NULL &&

‎src/lib/libcrypto/ecdsa/ecdsa.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: ecdsa.c,v 1.16 2023/07/28 09:18:10 tb Exp $ */
1+
/* $OpenBSD: ecdsa.c,v 1.17 2023/08/03 18:53:56 tb Exp $ */
22
/* ====================================================================
33
* Copyright (c) 2000-2002 The OpenSSL Project. All rights reserved.
44
*
@@ -338,7 +338,7 @@ ecdsa_sign_setup(EC_KEY *key, BN_CTX *in_ctx, BIGNUM **out_kinv, BIGNUM **out_r)
338338
/* Step 11: repeat until r != 0. */
339339
do {
340340
/* Step 3: generate random k. */
341-
if (!bn_rand_interval(k, BN_value_one(), order))
341+
if (!bn_rand_interval(k, 1, order))
342342
goto err;
343343

344344
/*
@@ -472,7 +472,7 @@ ecdsa_compute_s(BIGNUM **out_s, const BIGNUM *e, const BIGNUM *kinv,
472472
goto err;
473473
}
474474

475-
if (!bn_rand_interval(b, BN_value_one(), order)) {
475+
if (!bn_rand_interval(b, 1, order)) {
476476
ECerror(ERR_R_BN_LIB);
477477
goto err;
478478
}

0 commit comments

Comments
 (0)