diff options
| author | Jo Van Bulck <jo.vanbulck@cs.kuleuven.be> | 2017-01-19 17:00:15 +0100 |
|---|---|---|
| committer | Werner Koch <wk@gnupg.org> | 2017-06-01 15:52:10 +0200 |
| commit | 5a22de904a0a366ae79f03ff1e13a1232a89e26b (patch) | |
| tree | 32fad96216afb6a746608f23e9ab0e7a7370eaef /cipher/ecc-eddsa.c | |
| parent | 45c39340c9926c2c5801dbab7609687c41e9ff1f (diff) | |
| download | libgcrypt-5a22de904a0a366ae79f03ff1e13a1232a89e26b.tar.gz | |
ecc: Store EdDSA session key in secure memory.
* cipher/ecc-eddsa.c (_gcry_ecc_eddsa_sign): use mpi_snew to allocate
session key.
--
An attacker who learns the EdDSA session key from side-channel
observation during the signing process, can easily revover the long-
term secret key. Storing the session key in secure memory ensures that
constant time point operations are used in the MPI library.
Signed-off-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
Diffstat (limited to 'cipher/ecc-eddsa.c')
| -rw-r--r-- | cipher/ecc-eddsa.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cipher/ecc-eddsa.c b/cipher/ecc-eddsa.c index f91f8489..813e030d 100644 --- a/cipher/ecc-eddsa.c +++ b/cipher/ecc-eddsa.c @@ -603,7 +603,7 @@ _gcry_ecc_eddsa_sign (gcry_mpi_t input, ECC_secret_key *skey, a = mpi_snew (0); x = mpi_new (0); y = mpi_new (0); - r = mpi_new (0); + r = mpi_snew (0); ctx = _gcry_mpi_ec_p_internal_new (skey->E.model, skey->E.dialect, 0, skey->E.p, skey->E.a, skey->E.b); b = (ctx->nbits+7)/8; |