From: =?UTF-8?q?Stephan=20M=C3=BCller?= <smueller@chronox.de>

Date: Mon, 20 Jul 2020 19:07:48 +0200

Subject: crypto: ecdh - check validity of Z before export

Git-commit: e7d2b41e5c773c1e00f0f30519b9790ba7e4a58c

Patch-mainline: v5.9-rc1

References: bsc#1175718

SP800-56A rev3 section 5.7.1.2 step 2 mandates that the validity of the

calculated shared secret is verified before the data is returned to the

caller. Thus, the export function and the validity check functions are

reversed. In addition, the sensitive variables of priv and rand_z are

zeroized.

Signed-off-by: Stephan Mueller <smueller@chronox.de>

Reviewed-by: Vitaly Chikunov <vt@altlinux.org>

Acked-by: Neil Horman <nhorman@redhat.com>

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Acked-by: Petr Tesarik <ptesarik@suse.com>

---

 crypto/ecc.c |   11 ++++++++---

 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/crypto/ecc.c

+++ b/crypto/ecc.c

@@ -1495,11 +1495,16 @@ int crypto_ecdh_shared_secret(unsigned i

 	ecc_point_mult(product, pk, priv, rand_z, curve, ndigits);

-	ecc_swap_digits(product->x, secret, ndigits);

-

-	if (ecc_point_is_zero(product))

+	if (ecc_point_is_zero(product)) {

 		ret = -EFAULT;

+		goto err_validity;

+	}

+

+	ecc_swap_digits(product->x, secret, ndigits);

+err_validity:

+	memzero_explicit(priv, sizeof(priv));

+	memzero_explicit(rand_z, sizeof(rand_z));

 	ecc_free_point(product);

 err_alloc_product:

 	ecc_free_point(pk);