oss-sec mailing list archives
Miscomputations of elliptic curve scalar multiplications in Nettle
From: Hanno Böck <hanno () hboeck de>
Date: Tue, 2 Feb 2016 10:56:22 +0100
https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html The Nettle library is a library for basic cryptographic functions. Its most prominent user is GnuTLS. Through fuzzing of elliptic curve scalar multiplications (multiplying a point on an elliptic curve with a scalar number) I discovered two carry propagation bugs that would lead the cauculations to produce wrong results. They affect the NIST P-256 and P-384 curves. The P-256 bug is in the C code and affects multiple architectures. The P-384 bug is in the assembly code and only affects 64 bit x86. While analyzing these bugs Nettle developer Niels Möller discovered another carry propagation bug in P-256 that was fixed in the same commit. Nettle 3.2 fixes all three bugs. The impact is currently unclear, but miscalculations in cryptographic functions should generally be considered security issues. I'd like to encourage cryptographers to try to analyze whether these bugs can lead to cryptographic breaks. https://github.com/hannob/bignum-fuzz/blob/master/point-fuzz.c I have published a code example on how to fuzz elliptic curve multiplications. It can compare the output of OpenSSL with either Nettle or NSS. It currently works only with prime field curves, but it can probably be adapted to other curves. P-256 bug: https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003028.html Mailing list post with code sample https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d Commit / fix for P-256 bug P-384 bug: https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003024.html Mailing list post with code sample https://git.lysator.liu.se/nettle/nettle/commit/fa269b6ad06dd13c901dbd84a12e52b918a09cd7 Commit / fix for P-384 bug https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html Nettle 3.2 release notes -- Hanno Böck http://hboeck.de/ mail/jabber: hanno () hboeck de GPG: BBB51E42
Attachment:
_bin
Description: OpenPGP digital signature
Current thread:
- Miscomputations of elliptic curve scalar multiplications in Nettle Hanno Böck (Feb 02)
- Re: Miscomputations of elliptic curve scalar multiplications in Nettle cve-assign (Feb 02)