[git] GCRYPT - branch, master, updated. libgcrypt-1.5.0-172-g287bf0e

[by Werner Koch]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  287bf0e543f244d784cf8b58340bf0ab3c6aba97 (commit)
      from  37d0a1ebdc2dc74df4fb6bf0621045018122a68f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 287bf0e543f244d784cf8b58340bf0ab3c6aba97
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 25 11:17:52 2013 +0200

    Mitigate a flush+reload cache attack on RSA secret exponents.
    
    * mpi/mpi-pow.c (gcry_mpi_powm): Always perfrom the mpi_mul for
    exponents in secure memory.
    --
    
    The attack is published as http://eprint.iacr.org/2013/448 :
    
    Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel
    Attack by Yuval Yarom and Katrina Falkner. 18 July 2013.
    
      Flush+Reload is a cache side-channel attack that monitors access to
      data in shared pages. In this paper we demonstrate how to use the
      attack to extract private encryption keys from GnuPG.  The high
      resolution and low noise of the Flush+Reload attack enables a spy
      program to recover over 98% of the bits of the private key in a
      single decryption or signing round. Unlike previous attacks, the
      attack targets the last level L3 cache. Consequently, the spy
      program and the victim do not need to share the execution core of
      the CPU. The attack is not limited to a traditional OS and can be
      used in a virtualised environment, where it can attack programs
      executing in a different VM.
    
    (cherry picked from commit 55237c8f6920c6629debd23db65e90b42a3767de)

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index 7ec49d7..85d6fd8 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -1,6 +1,7 @@
 /* mpi-pow.c  -  MPI functions for exponentiation
  * Copyright (C) 1994, 1996, 1998, 2000, 2002
  *               2003  Free Software Foundation, Inc.
+ *               2013  g10 Code GmbH
  *
  * This file is part of Libgcrypt.
  *
@@ -235,7 +236,13 @@ gcry_mpi_powm (gcry_mpi_t res,
             tp = rp; rp = xp; xp = tp;
             rsize = xsize;
 
-            if ( (mpi_limb_signed_t)e < 0 )
+            /* To mitigate the Yarom/Falkner flush+reload cache
+             * side-channel attack on the RSA secret exponent, we do
+             * the multiplication regardless of the value of the
+             * high-bit of E.  But to avoid this performance penalty
+             * we do it only if the exponent has been stored in secure
+             * memory and we can thus assume it is a secret exponent.  */
+            if (esec || (mpi_limb_signed_t)e < 0)
               {
                 /*mpih_mul( xp, rp, rsize, bp, bsize );*/
                 if( bsize < KARATSUBA_THRESHOLD )
@@ -250,7 +257,9 @@ gcry_mpi_powm (gcry_mpi_t res,
                     _gcry_mpih_divrem(xp + msize, 0, xp, xsize, mp, msize);
                     xsize = msize;
                   }
-
+              }
+            if ( (mpi_limb_signed_t)e < 0 )
+              {
                 tp = rp; rp = xp; xp = tp;
                 rsize = xsize;
               }

-----------------------------------------------------------------------

Summary of changes:
 mpi/mpi-pow.c |   13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org