[PATCH] mpi:ec: Fix for use of ec_mulm_lli in _gcry_mpi_ec_get_affine.
NIIBE Yutaka via Gcrypt-devel <[email protected]> Fri, 12 Dec 2025 14:06:27 +0900
| Newsgroups | gmane.comp.encryption.gpg.libgcrypt.devel |
|---|---|
| Message-ID | <92bbe34514ee180c074b882d8459cdf6b873ba0c.1765515944.git.gniibe@fsij.org> |
* mpi/ec.c (_gcry_mpi_ec_get_affine): Resize X and Y. Add GCRYECC_FLAG_LEAST_LEAK flag. -- Fixes-commit: aa089ec89badcd74817e5008c66036b1e28674f5 Reported-by: Kr0emer <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]> --- mpi/ec.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) _______________________________________________ Gcrypt-devel mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gcrypt-devel
0001-mpi-ec-Fix-for-use-of-ec_mulm_lli-in-_gcry_mpi_ec_ge.patch
(text/x-patch, 1.4 KB)
diff --git a/mpi/ec.c b/mpi/ec.c
index c93500db..d7bad4a6 100644
--- a/mpi/ec.c
+++ b/mpi/ec.c
@@ -1198,6 +1198,7 @@ _gcry_mpi_ec_get_affine (gcry_mpi_t x, gcry_mpi_t y, mpi_point_t point,
case MPI_EC_WEIERSTRASS: /* Using Jacobian coordinates. */
{
gcry_mpi_t z1, z2, z3;
+ int saved_flags;
if (!mpi_cmp_ui (point->z, 1))
{
@@ -1208,22 +1209,34 @@ _gcry_mpi_ec_get_affine (gcry_mpi_t x, gcry_mpi_t y, mpi_point_t point,
return 0;
}
+ /* Since we use LLI computations, the LL flag should be set. */
+ saved_flags = ctx->flags;
+ ctx->flags |= GCRYECC_FLAG_LEAST_LEAK;
+
z1 = mpi_new (0);
z2 = mpi_new (0);
ec_invm (z1, point->z, ctx); /* z1 = z^(-1) mod p */
ec_mulm_lli (z2, z1, z1, ctx); /* z2 = z^(-2) mod p */
if (x)
- ec_mulm_lli (x, point->x, z2, ctx);
+ {
+ mpi_resize (point->x, ctx->p->nlimbs);
+ point->x->nlimbs = ctx->p->nlimbs;
+ ec_mulm_lli (x, point->x, z2, ctx);
+ }
if (y)
{
+ mpi_resize (point->y, ctx->p->nlimbs);
+ point->y->nlimbs = ctx->p->nlimbs;
z3 = mpi_new (0);
ec_mulm_lli (z3, z2, z1, ctx); /* z3 = z^(-3) mod p */
ec_mulm_lli (y, point->y, z3, ctx);
mpi_free (z3);
}
+ ctx->flags = saved_flags;
+
mpi_free (z2);
mpi_free (z1);
}