RSA Decryption: check private value after decryption #7167
Conversation
| @@ -2723,6 +2723,17 @@ static int RsaFunctionSync(const byte* in, word32 inLen, byte* out, | |||
| if (mp_to_unsigned_bin_len_ct(tmp, out, (int)*outLen) != MP_OKAY) | |||
| ret = MP_TO_E; | |||
| } | |||
| #ifdef WOLFSSL_RSA_CHECK_D_ON_DECRYPT | |||
There was a problem hiding this comment.
Is this something that should be on be default and optionally turned off rather than off be default and optionally turned on?
There was a problem hiding this comment.
Would it make sense to enable with WOLFSSL_CHECK_SIG_FAULTS?
There was a problem hiding this comment.
WOLFSSL_CHECK_SIG_FAULTS is currently for signature and ECC.
This code is only for RSA decryption and not signing.
If there was a better generic 'check data after op' define, I would consider enabling it as part of that.
There was a problem hiding this comment.
@SparkiDev should this be on by default and have a different macro name to disable it?
There was a problem hiding this comment.
There are very limited circumstances that would require the checking of d.
It is unnecessary work that we should avoided if possible.
There was a problem hiding this comment.
Let's merge as-is then document clearly those reasons
JacobBarthelmeh
assigned SparkiDev and dgarske and unassigned wolfSSL-Bot and SparkiDev
| @@ -2723,6 +2723,17 @@ static int RsaFunctionSync(const byte* in, word32 inLen, byte* out, | |||
| if (mp_to_unsigned_bin_len_ct(tmp, out, (int)*outLen) != MP_OKAY) | |||
| ret = MP_TO_E; | |||
| } | |||
| #ifdef WOLFSSL_RSA_CHECK_D_ON_DECRYPT | |||
There was a problem hiding this comment.
Would it make sense to enable with WOLFSSL_CHECK_SIG_FAULTS?
| @@ -2723,6 +2723,17 @@ static int RsaFunctionSync(const byte* in, word32 inLen, byte* out, | |||
| if (mp_to_unsigned_bin_len_ct(tmp, out, (int)*outLen) != MP_OKAY) | |||
| ret = MP_TO_E; | |||
| } | |||
| #ifdef WOLFSSL_RSA_CHECK_D_ON_DECRYPT | |||
There was a problem hiding this comment.
@SparkiDev should this be on by default and have a different macro name to disable it?
Description
After RSA decryption check d is still valid.
Fixes zd#17266
Testing
Ran tests with WOLFSSL_RSA_CHECK_D_ON_DECRYPT defined.
Benchmark difference was negligible.
Checklist