File Botan-CVE-2024-50382.patch of Package Botan.18630

From 53b0cfde580e86b03d0d27a488b6c134f662e957 Mon Sep 17 00:00:00 2001
From: Jack Lloyd <jack@randombit.net>
Date: Sat, 19 Oct 2024 07:43:18 -0400
Subject: [PATCH] Add more value barriers to avoid compiler induced side
 channels

The paper https://arxiv.org/pdf/2410.13489 claims that on specific
architectures Clang and GCC may introduce jumps here. The donna128
issues only affect 32-bit processors, which explains why we would not
see it in the x86-64 valgrind runs.

The GHASH leak would seem to be generic but the authors only observed
it on RISC-V.
---
 src/lib/utils/donna128.h      | 5 +++--
 src/lib/utils/ghash/ghash.cpp | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

Index: Botan-2.19.5/src/lib/utils/donna128.h
===================================================================
--- Botan-2.19.5.orig/src/lib/utils/donna128.h
+++ Botan-2.19.5/src/lib/utils/donna128.h
@@ -8,6 +8,7 @@
 #ifndef BOTAN_CURVE25519_DONNA128_H_
 #define BOTAN_CURVE25519_DONNA128_H_
 
+#include <botan/internal/ct_utils.h>
 #include <botan/mul128.h>
 
 namespace Botan {
@@ -61,7 +62,7 @@ class donna128 final
          l += x.l;
          h += x.h;
 
-         const uint64_t carry = (l < x.l);
+         const uint64_t carry = CT::Mask<uint64_t>::is_lt(l, x.l).if_set_return(1);
          h += carry;
          return *this;
          }
@@ -69,7 +70,7 @@ class donna128 final
       donna128& operator+=(uint64_t x)
          {
          l += x;
-         const uint64_t carry = (l < x);
+         const uint64_t carry = CT::Mask<uint64_t>::is_lt(l, x).if_set_return(1);
          h += carry;
          return *this;
          }
Index: Botan-2.19.5/src/lib/utils/ghash/ghash.cpp
===================================================================
--- Botan-2.19.5.orig/src/lib/utils/ghash/ghash.cpp
+++ Botan-2.19.5/src/lib/utils/ghash/ghash.cpp
@@ -139,7 +139,7 @@ void GHASH::key_schedule(const uint8_t k
          m_HM[4*j+2*i+1] = H1;
 
          // GCM's bit ops are reversed so we carry out of the bottom
-         const uint64_t carry = R * (H1 & 1);
+         const uint64_t carry = CT::Mask<uint64_t>::expand(H1 & 1).if_set_return(R);
          H1 = (H1 >> 1) | (H0 << 63);
          H0 = (H0 >> 1) ^ carry;
          }