Gilles Peskine 132c0976e9 Remove a secret-dependent branch in Montgomery multiplication
In mpi_montmul, an auxiliary function for modular
exponentiation (mbedtls_mpi_mod_exp) that performs Montgomery
multiplication, the last step is a conditional subtraction to force
the result into the correct range. The current implementation uses a
branch and therefore may leak information about secret data to an
adversary who can observe what branch is taken through a side channel.

Avoid this potential leak by always doing the same subtraction and
doing a contant-trace conditional assignment to set the result.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:23 +02:00
..
2020-04-22 16:01:48 +02:00
2019-08-15 15:44:50 +01:00
2019-08-15 15:44:50 +01:00
2019-08-15 15:44:50 +01:00
2019-08-15 15:44:50 +01:00
2019-08-15 15:44:50 +01:00
2019-08-15 15:44:50 +01:00
2019-12-03 16:07:18 +00:00
2020-04-22 16:01:48 +02:00
2020-04-22 16:01:48 +02:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2020-05-25 12:23:55 +02:00
2019-08-15 15:44:50 +01:00
2020-04-02 19:54:51 +02:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2019-08-15 15:44:50 +01:00
2019-12-03 16:07:18 +00:00
2020-04-22 16:01:48 +02:00
2019-08-15 15:44:50 +01:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2020-02-18 10:31:29 +01:00
2019-08-15 15:44:50 +01:00
2020-01-28 14:43:52 -05:00
2019-12-03 16:07:18 +00:00
2019-12-03 16:07:18 +00:00
2020-01-29 09:46:49 +01:00
2019-08-15 15:44:50 +01:00
2019-08-15 15:44:50 +01:00