mirror of
https://github.com/openwrt/openwrt.git
synced 2025-01-03 04:26:55 +00:00
f6d8c0cf2b
Since commit 6467de5a8840 ("Randomize z ordinates in scalar
mult when timing resistant") wolfssl requires a RNG for an EC
key when the hardened built option is selected.
wc_ecc_set_rng is only available when built hardened, so there
is no safe way to install the RNG to the key regardless whether
or not wolfssl is compiled hardened.
Always export wc_ecc_set_rng so tools such as hostapd can install
RNG regardless of the built settings for wolfssl.
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit ef9b103107)
51 lines
1.2 KiB
Diff
51 lines
1.2 KiB
Diff
Since commit 6467de5a8840 ("Randomize z ordinates in scalar
|
|
mult when timing resistant") wolfssl requires a RNG for an EC
|
|
key when the hardened built option is selected.
|
|
|
|
wc_ecc_set_rng is only available when built hardened, so there
|
|
is no safe way to install the RNG to the key regardless whether
|
|
or not wolfssl is compiled hardened.
|
|
|
|
Always export wc_ecc_set_rng so tools such as hostapd can install
|
|
RNG regardless of the built settings for wolfssl.
|
|
|
|
--- a/wolfcrypt/src/ecc.c
|
|
+++ b/wolfcrypt/src/ecc.c
|
|
@@ -10293,21 +10293,21 @@ void wc_ecc_fp_free(void)
|
|
|
|
#endif /* FP_ECC */
|
|
|
|
-#ifdef ECC_TIMING_RESISTANT
|
|
int wc_ecc_set_rng(ecc_key* key, WC_RNG* rng)
|
|
{
|
|
int err = 0;
|
|
|
|
+#ifdef ECC_TIMING_RESISTANT
|
|
if (key == NULL) {
|
|
err = BAD_FUNC_ARG;
|
|
}
|
|
else {
|
|
key->rng = rng;
|
|
}
|
|
+#endif
|
|
|
|
return err;
|
|
}
|
|
-#endif
|
|
|
|
#ifdef HAVE_ECC_ENCRYPT
|
|
|
|
--- a/wolfssl/wolfcrypt/ecc.h
|
|
+++ b/wolfssl/wolfcrypt/ecc.h
|
|
@@ -584,10 +584,8 @@ WOLFSSL_API
|
|
void wc_ecc_fp_free(void);
|
|
WOLFSSL_LOCAL
|
|
void wc_ecc_fp_init(void);
|
|
-#ifdef ECC_TIMING_RESISTANT
|
|
WOLFSSL_API
|
|
int wc_ecc_set_rng(ecc_key* key, WC_RNG* rng);
|
|
-#endif
|
|
|
|
WOLFSSL_API
|
|
int wc_ecc_set_curve(ecc_key* key, int keysize, int curve_id);
|