File openssl-CVE-2024-13176.patch of Package openssl-1_1.37303

commit 4b1cb94a734a7d4ec363ac0a215a25c181e11f65
Author: Tomas Mraz <tomas@openssl.org>
Date:   Wed Jan 15 18:27:02 2025 +0100

    Fix timing side-channel in ECDSA signature computation
    
    There is a timing signal of around 300 nanoseconds when the top word of
    the inverted ECDSA nonce value is zero. This can happen with significant
    probability only for some of the supported elliptic curves. In particular
    the NIST P-521 curve is affected. To be able to measure this leak, the
    attacker process must either be located in the same physical computer or
    must have a very fast network connection with low latency.
    
    Attacks on ECDSA nonce are also known as Minerva attack.
    
    Fixes CVE-2024-13176
    
    Reviewed-by: Tim Hudson <tjh@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Paul Dale <ppzgs1@gmail.com>
    (Merged from https://github.com/openssl/openssl/pull/26429)
    
    (cherry picked from commit 63c40a66c5dc287485705d06122d3a6e74a6a203)
    (cherry picked from commit 392dcb336405a0c94486aa6655057f59fd3a0902)

Index: openssl-1.1.1d/crypto/bn/bn_exp.c
===================================================================
--- openssl-1.1.1d.orig/crypto/bn/bn_exp.c
+++ openssl-1.1.1d/crypto/bn/bn_exp.c
@@ -589,7 +589,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBU
  * out by Colin Percival,
  * http://www.daemonology.net/hyperthreading-considered-harmful/)
  */
-int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                               const BIGNUM *m, BN_CTX *ctx,
                               BN_MONT_CTX *in_mont)
 {
@@ -606,10 +606,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
     unsigned int t4 = 0;
 #endif
 
-    bn_check_top(a);
-    bn_check_top(p);
-    bn_check_top(m);
-
     if (!BN_is_odd(m)) {
         BNerr(BN_F_BN_MOD_EXP_MONT_CONSTTIME, BN_R_CALLED_WITH_EVEN_MODULUS);
         return 0;
@@ -1112,7 +1108,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
             goto err;
     } else
 #endif
-    if (!BN_from_montgomery(rr, &tmp, mont, ctx))
+    if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx))
         goto err;
     ret = 1;
  err:
@@ -1126,6 +1122,19 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
     return ret;
 }
 
+int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+                              const BIGNUM *m, BN_CTX *ctx,
+                              BN_MONT_CTX *in_mont)
+{
+    bn_check_top(a);
+    bn_check_top(p);
+    bn_check_top(m);
+    if (!bn_mod_exp_mont_fixed_top(rr, a, p, m, ctx, in_mont))
+        return 0;
+    bn_correct_top(rr);
+    return 1;
+}
+
 int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
 {
Index: openssl-1.1.1d/crypto/ec/ec_lib.c
===================================================================
--- openssl-1.1.1d.orig/crypto/ec/ec_lib.c
+++ openssl-1.1.1d/crypto/ec/ec_lib.c
@@ -13,6 +13,7 @@
 #include <openssl/err.h>
 #include <openssl/opensslv.h>
 
+#include "internal/bn_int.h"
 #include "ec_lcl.h"
 
 /* functions for EC_GROUP objects */
@@ -1159,10 +1160,10 @@ static int ec_field_inverse_mod_ord(cons
     if (!BN_sub(e, group->order, e))
         goto err;
     /*-
-     * Exponent e is public.
-     * No need for scatter-gather or BN_FLG_CONSTTIME.
+     * Although the exponent is public we want the result to be
+     * fixed top.
      */
-    if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data))
+    if (!bn_mod_exp_mont_fixed_top(r, x, e, group->order, ctx, group->mont_data))
         goto err;
 
     ret = 1;
Index: openssl-1.1.1d/crypto/include/internal/bn_int.h
===================================================================
--- openssl-1.1.1d.orig/crypto/include/internal/bn_int.h
+++ openssl-1.1.1d/crypto/include/internal/bn_int.h
@@ -72,6 +72,9 @@ int bn_set_words(BIGNUM *a, const BN_ULO
  */
 int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                           BN_MONT_CTX *mont, BN_CTX *ctx);
+int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+                              const BIGNUM *m, BN_CTX *ctx,
+                              BN_MONT_CTX *in_mont);
 int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
                          BN_CTX *ctx);
 int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,