tree 4e7e8bc9f129fd50d81e2e9efced3adea90e9181
parent c22365b399f62af4a81e9202500cd2cbd9c23a9d
author Matt Caswell <matt@openssl.org> 1526461107 +0100
committer Matt Caswell <matt@openssl.org> 1526572631 +0100

Make BN_GF2m_mod_arr more constant time

Experiments have shown that the lookup table used by BN_GF2m_mod_arr
introduces sufficient timing signal to recover the private key for an
attacker with access to cache timing information on the victim's host.
This only affects binary curves (which are less frequently used).

No CVE is considered necessary for this issue.

The fix is to replace the lookup table with an on-the-fly calculation of
the value from the table instead, which can be performed in constant time.

Thanks to Youngjoo Shin for reporting this issue.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6270)