From ddb5a7d19783f251b114e0f515c3fd41ec4137f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 9 Oct 2026 09:50:12 +0200 Subject: [PATCH 1/5] Revert "bignum: fix a typo in a comment" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit c6a1f9c83899cefd94612b59da682d4d9856a63a. Signed-off-by: Manuel Pégourié-Gonnard --- library/bignum.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/bignum.c b/library/bignum.c index 03201a99a3..754462a10d 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -2128,7 +2128,7 @@ static int mpi_check_small_factors(const mbedtls_mpi *X) } /* We can't directly use mbedtls_mpi_gcd_modinv_odd() because we don't know - * if X is larger than prod or not (prod is 1380 bits). So, use this generic + * if X is larger than prod or not (prod is 1379 bits). So, use this generic * wrapper - it does a bit more than what we need (handles even inputs as * well, while we know our inputs are both odd), but that's OK. */ MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&g, &small_primes_product, X)); From 9585f8201ea62899095eca315860735ab979917e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 9 Oct 2026 09:50:20 +0200 Subject: [PATCH 2/5] Revert "bignum: compact primality check for small values" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 075e76b65ba1e25002f60e46460e397462c3667a. Signed-off-by: Manuel Pégourié-Gonnard --- library/bignum.c | 43 +++++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-) diff --git a/library/bignum.c b/library/bignum.c index 754462a10d..89b2d689b6 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -2092,6 +2092,31 @@ static const mbedtls_mpi small_primes_product = { .s = 1, .n = sizeof(small_primes_product_limbs) / sizeof(mbedtls_mpi_uint), }; +/* Gaps between primes, starting at 3. https://oeis.org/A001223 */ +static const unsigned char small_prime_gaps[] = { + 2, 2, 4, 2, 4, 2, 4, 6, + 2, 6, 4, 2, 4, 6, 6, 2, + 6, 4, 2, 6, 4, 6, 8, 4, + 2, 4, 2, 4, 14, 4, 6, 2, + 10, 2, 6, 6, 4, 6, 6, 2, + 10, 2, 4, 2, 12, 12, 4, 2, + 4, 6, 2, 10, 6, 6, 6, 2, + 6, 4, 2, 10, 14, 4, 2, 4, + 14, 6, 10, 2, 4, 6, 8, 6, + 6, 4, 6, 8, 4, 8, 10, 2, + 10, 2, 6, 4, 6, 8, 4, 2, + 4, 12, 8, 4, 8, 4, 6, 12, + 2, 18, 6, 10, 6, 6, 2, 6, + 10, 6, 6, 2, 6, 6, 4, 2, + 12, 10, 2, 4, 6, 6, 2, 12, + 4, 6, 8, 10, 8, 10, 8, 6, + 6, 4, 8, 6, 4, 8, 4, 14, + 10, 12, 2, 10, 2, 4, 2, 10, + 14, 4, 2, 4, 14, 4, 2, 4, + 20, 4, 8, 10, 8, 4, 6, 6, + 14, 4, 6, 6, 8, 6, /*reaches 997*/ + 0 /* the last entry is effectively unused */ +}; /* * Small divisors test (X must be positive) @@ -2113,18 +2138,16 @@ static int mpi_check_small_factors(const mbedtls_mpi *X) return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; } - /* The GCD test below only works if X > small_primes_limit. - * Below this limit, use trial division: numbers that small are of no - * interest for cryptography, so we don't care about performance or side - * channels. We're supporting them only for backwards compatibility, so - * let's not waste code size on those. */ + /* The GCD test below only works if X > small_primes_limit. */ if (mbedtls_mpi_cmp_int(X, small_primes_limit) <= 0) { - mbedtls_mpi_uint x = X->p[0]; - mbedtls_mpi_uint d = 2; - while (x % d != 0) { - ++d; + unsigned p = 3; + for (size_t i = 0; i < sizeof(small_prime_gaps); i++) { + if (mbedtls_mpi_cmp_int(X, p) == 0) { + return 1; + } + p += small_prime_gaps[i]; } - return x == d ? 1 : MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; + return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; } /* We can't directly use mbedtls_mpi_gcd_modinv_odd() because we don't know From 311c4dff5aead49931b8f65de9168c4404185e4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 9 Oct 2026 09:50:27 +0200 Subject: [PATCH 3/5] Revert "bignum: make small primes product static" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 1a3cfa5fe7c1e4b1702d6f9ea573fa4fa8d84ce4. Signed-off-by: Manuel Pégourié-Gonnard --- library/bignum.c | 57 ++++++++++++++++++++---------------------------- 1 file changed, 24 insertions(+), 33 deletions(-) diff --git a/library/bignum.c b/library/bignum.c index 89b2d689b6..5ba85daecc 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -2059,38 +2059,24 @@ int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi #if defined(MBEDTLS_GENPRIME) +/* Product of small primes up to 997 included */ static const mbedtls_mpi_sint small_primes_limit = 997; -/* Product of small primes up to small_primes_limit included */ -static const mbedtls_mpi_uint small_primes_product_limbs[] = { - MBEDTLS_BYTES_TO_T_UINT_8(0x4b, 0x13, 0x6a, 0x97, 0xbb, 0xd0, 0xdf, 0x95), - MBEDTLS_BYTES_TO_T_UINT_8(0xa7, 0x2c, 0x10, 0xa4, 0x20, 0xa4, 0x9f, 0x7b), - MBEDTLS_BYTES_TO_T_UINT_8(0x9d, 0x18, 0xd6, 0xdf, 0xc0, 0xf5, 0x61, 0x65), - MBEDTLS_BYTES_TO_T_UINT_8(0xfc, 0x35, 0x79, 0xfb, 0x30, 0xa8, 0xd5, 0xbf), - MBEDTLS_BYTES_TO_T_UINT_8(0xdb, 0x37, 0xba, 0x2c, 0xfb, 0xbb, 0x89, 0xfb), - MBEDTLS_BYTES_TO_T_UINT_8(0xad, 0xc2, 0x8c, 0x1d, 0x99, 0x18, 0xe8, 0xe5), - MBEDTLS_BYTES_TO_T_UINT_8(0x8d, 0x77, 0xc9, 0x5d, 0x96, 0x8a, 0x61, 0x9d), - MBEDTLS_BYTES_TO_T_UINT_8(0x39, 0x41, 0x3e, 0xf4, 0x34, 0x07, 0x57, 0xe0), - MBEDTLS_BYTES_TO_T_UINT_8(0x4a, 0xf1, 0x54, 0x3a, 0x43, 0x67, 0x46, 0xa2), - MBEDTLS_BYTES_TO_T_UINT_8(0x83, 0x0c, 0xe5, 0x31, 0xa2, 0xfc, 0x05, 0x45), - MBEDTLS_BYTES_TO_T_UINT_8(0xf0, 0x1d, 0x66, 0xfc, 0x7a, 0x85, 0x37, 0xe1), - MBEDTLS_BYTES_TO_T_UINT_8(0x17, 0xe0, 0x80, 0x62, 0x0d, 0xa2, 0xbc, 0x32), - MBEDTLS_BYTES_TO_T_UINT_8(0x6d, 0xce, 0x84, 0x68, 0x00, 0xb5, 0xe3, 0x35), - MBEDTLS_BYTES_TO_T_UINT_8(0x14, 0x19, 0x0d, 0xe4, 0x92, 0xd5, 0xd8, 0xdf), - MBEDTLS_BYTES_TO_T_UINT_8(0x20, 0x1c, 0x7d, 0x38, 0x3b, 0xe8, 0xd9, 0xa8), - MBEDTLS_BYTES_TO_T_UINT_8(0xf6, 0xac, 0x11, 0xe6, 0xb4, 0x03, 0xf7, 0x6c), - MBEDTLS_BYTES_TO_T_UINT_8(0x78, 0x3d, 0xf2, 0x3a, 0x8f, 0xf9, 0x2f, 0x6a), - MBEDTLS_BYTES_TO_T_UINT_8(0x7b, 0x72, 0x66, 0xa9, 0x48, 0xe4, 0x6d, 0x02), - MBEDTLS_BYTES_TO_T_UINT_8(0x69, 0xc7, 0x32, 0xcb, 0xf2, 0xf7, 0xa9, 0x0b), - MBEDTLS_BYTES_TO_T_UINT_8(0xd3, 0x52, 0x72, 0x9d, 0xbf, 0x54, 0xea, 0xc7), - MBEDTLS_BYTES_TO_T_UINT_8(0xf5, 0xf3, 0x8a, 0xc5, 0xf0, 0xe1, 0x21, 0x81), - MBEDTLS_BYTES_TO_T_UINT_8(0x8e, 0x61, 0x78, 0xf0, 0x05, 0x00, 0x00, 0x00), -}; -/* Could make ECP_MPI_INIT_ARRAY() available outside ecp, but not doing it now - * as it would lead to conflicts with other in-flight PRs. */ -static const mbedtls_mpi small_primes_product = { - .p = (mbedtls_mpi_uint *) small_primes_product_limbs, - .s = 1, - .n = sizeof(small_primes_product_limbs) / sizeof(mbedtls_mpi_uint), +static const unsigned char small_primes_product_bin[] = { + 0x05, 0xf0, 0x78, 0x61, 0x8e, 0x81, 0x21, 0xe1, 0xf0, 0xc5, 0x8a, 0xf3, + 0xf5, 0xc7, 0xea, 0x54, 0xbf, 0x9d, 0x72, 0x52, 0xd3, 0x0b, 0xa9, 0xf7, + 0xf2, 0xcb, 0x32, 0xc7, 0x69, 0x02, 0x6d, 0xe4, 0x48, 0xa9, 0x66, 0x72, + 0x7b, 0x6a, 0x2f, 0xf9, 0x8f, 0x3a, 0xf2, 0x3d, 0x78, 0x6c, 0xf7, 0x03, + 0xb4, 0xe6, 0x11, 0xac, 0xf6, 0xa8, 0xd9, 0xe8, 0x3b, 0x38, 0x7d, 0x1c, + 0x20, 0xdf, 0xd8, 0xd5, 0x92, 0xe4, 0x0d, 0x19, 0x14, 0x35, 0xe3, 0xb5, + 0x00, 0x68, 0x84, 0xce, 0x6d, 0x32, 0xbc, 0xa2, 0x0d, 0x62, 0x80, 0xe0, + 0x17, 0xe1, 0x37, 0x85, 0x7a, 0xfc, 0x66, 0x1d, 0xf0, 0x45, 0x05, 0xfc, + 0xa2, 0x31, 0xe5, 0x0c, 0x83, 0xa2, 0x46, 0x67, 0x43, 0x3a, 0x54, 0xf1, + 0x4a, 0xe0, 0x57, 0x07, 0x34, 0xf4, 0x3e, 0x41, 0x39, 0x9d, 0x61, 0x8a, + 0x96, 0x5d, 0xc9, 0x77, 0x8d, 0xe5, 0xe8, 0x18, 0x99, 0x1d, 0x8c, 0xc2, + 0xad, 0xfb, 0x89, 0xbb, 0xfb, 0x2c, 0xba, 0x37, 0xdb, 0xbf, 0xd5, 0xa8, + 0x30, 0xfb, 0x79, 0x35, 0xfc, 0x65, 0x61, 0xf5, 0xc0, 0xdf, 0xd6, 0x18, + 0x9d, 0x7b, 0x9f, 0xa4, 0x20, 0xa4, 0x10, 0x2c, 0xa7, 0x95, 0xdf, 0xd0, + 0xbb, 0x97, 0x6a, 0x13, 0x4b, }; /* Gaps between primes, starting at 3. https://oeis.org/A001223 */ static const unsigned char small_prime_gaps[] = { @@ -2130,8 +2116,9 @@ static const unsigned char small_prime_gaps[] = { static int mpi_check_small_factors(const mbedtls_mpi *X) { int ret = 0; - mbedtls_mpi g; + mbedtls_mpi prod, g; + mbedtls_mpi_init(&prod); mbedtls_mpi_init(&g); if ((X->p[0] & 1) == 0) { @@ -2150,11 +2137,14 @@ static int mpi_check_small_factors(const mbedtls_mpi *X) return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; } + MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&prod, small_primes_product_bin, + sizeof(small_primes_product_bin))); + /* We can't directly use mbedtls_mpi_gcd_modinv_odd() because we don't know * if X is larger than prod or not (prod is 1379 bits). So, use this generic * wrapper - it does a bit more than what we need (handles even inputs as * well, while we know our inputs are both odd), but that's OK. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&g, &small_primes_product, X)); + MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&g, &prod, X)); if (mbedtls_mpi_cmp_int(&g, 1) == 0) { /* X is not divisible by a small prime */ @@ -2164,6 +2154,7 @@ static int mpi_check_small_factors(const mbedtls_mpi *X) } cleanup: + mbedtls_mpi_free(&prod); mbedtls_mpi_free(&g); return ret; } From 4344ca44178d130e541afdf2b652f3355fab1ae9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 9 Oct 2026 09:50:34 +0200 Subject: [PATCH 4/5] Revert "Fix side-channel in prime checking/generation" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 7a29052238b176b02b82d54d9f929fd4c368c008. Signed-off-by: Manuel Pégourié-Gonnard --- library/bignum.c | 55 +++++++----------------------------------------- 1 file changed, 8 insertions(+), 47 deletions(-) diff --git a/library/bignum.c b/library/bignum.c index 5ba85daecc..f6b8f99981 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -2059,25 +2059,6 @@ int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi #if defined(MBEDTLS_GENPRIME) -/* Product of small primes up to 997 included */ -static const mbedtls_mpi_sint small_primes_limit = 997; -static const unsigned char small_primes_product_bin[] = { - 0x05, 0xf0, 0x78, 0x61, 0x8e, 0x81, 0x21, 0xe1, 0xf0, 0xc5, 0x8a, 0xf3, - 0xf5, 0xc7, 0xea, 0x54, 0xbf, 0x9d, 0x72, 0x52, 0xd3, 0x0b, 0xa9, 0xf7, - 0xf2, 0xcb, 0x32, 0xc7, 0x69, 0x02, 0x6d, 0xe4, 0x48, 0xa9, 0x66, 0x72, - 0x7b, 0x6a, 0x2f, 0xf9, 0x8f, 0x3a, 0xf2, 0x3d, 0x78, 0x6c, 0xf7, 0x03, - 0xb4, 0xe6, 0x11, 0xac, 0xf6, 0xa8, 0xd9, 0xe8, 0x3b, 0x38, 0x7d, 0x1c, - 0x20, 0xdf, 0xd8, 0xd5, 0x92, 0xe4, 0x0d, 0x19, 0x14, 0x35, 0xe3, 0xb5, - 0x00, 0x68, 0x84, 0xce, 0x6d, 0x32, 0xbc, 0xa2, 0x0d, 0x62, 0x80, 0xe0, - 0x17, 0xe1, 0x37, 0x85, 0x7a, 0xfc, 0x66, 0x1d, 0xf0, 0x45, 0x05, 0xfc, - 0xa2, 0x31, 0xe5, 0x0c, 0x83, 0xa2, 0x46, 0x67, 0x43, 0x3a, 0x54, 0xf1, - 0x4a, 0xe0, 0x57, 0x07, 0x34, 0xf4, 0x3e, 0x41, 0x39, 0x9d, 0x61, 0x8a, - 0x96, 0x5d, 0xc9, 0x77, 0x8d, 0xe5, 0xe8, 0x18, 0x99, 0x1d, 0x8c, 0xc2, - 0xad, 0xfb, 0x89, 0xbb, 0xfb, 0x2c, 0xba, 0x37, 0xdb, 0xbf, 0xd5, 0xa8, - 0x30, 0xfb, 0x79, 0x35, 0xfc, 0x65, 0x61, 0xf5, 0xc0, 0xdf, 0xd6, 0x18, - 0x9d, 0x7b, 0x9f, 0xa4, 0x20, 0xa4, 0x10, 0x2c, 0xa7, 0x95, 0xdf, 0xd0, - 0xbb, 0x97, 0x6a, 0x13, 0x4b, -}; /* Gaps between primes, starting at 3. https://oeis.org/A001223 */ static const unsigned char small_prime_gaps[] = { 2, 2, 4, 2, 4, 2, 4, 6, @@ -2116,46 +2097,26 @@ static const unsigned char small_prime_gaps[] = { static int mpi_check_small_factors(const mbedtls_mpi *X) { int ret = 0; - mbedtls_mpi prod, g; - - mbedtls_mpi_init(&prod); - mbedtls_mpi_init(&g); + size_t i; + mbedtls_mpi_uint r; + unsigned p = 3; /* The first odd prime */ if ((X->p[0] & 1) == 0) { return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; } - /* The GCD test below only works if X > small_primes_limit. */ - if (mbedtls_mpi_cmp_int(X, small_primes_limit) <= 0) { - unsigned p = 3; - for (size_t i = 0; i < sizeof(small_prime_gaps); i++) { + for (i = 0; i < sizeof(small_prime_gaps); p += small_prime_gaps[i], i++) { + MBEDTLS_MPI_CHK(mbedtls_mpi_mod_int(&r, X, p)); + if (r == 0) { if (mbedtls_mpi_cmp_int(X, p) == 0) { return 1; + } else { + return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; } - p += small_prime_gaps[i]; } - return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&prod, small_primes_product_bin, - sizeof(small_primes_product_bin))); - - /* We can't directly use mbedtls_mpi_gcd_modinv_odd() because we don't know - * if X is larger than prod or not (prod is 1379 bits). So, use this generic - * wrapper - it does a bit more than what we need (handles even inputs as - * well, while we know our inputs are both odd), but that's OK. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&g, &prod, X)); - - if (mbedtls_mpi_cmp_int(&g, 1) == 0) { - /* X is not divisible by a small prime */ - ret = 0; - } else { - ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; } cleanup: - mbedtls_mpi_free(&prod); - mbedtls_mpi_free(&g); return ret; } From e42ac5aafe1a873022ea1d0795c40feb9bba6e2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 9 Oct 2026 09:30:18 +0200 Subject: [PATCH 5/5] Add ChangeLog entry for reversal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- ChangeLog.d/revert-rsa-keygen-hardening.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/revert-rsa-keygen-hardening.txt diff --git a/ChangeLog.d/revert-rsa-keygen-hardening.txt b/ChangeLog.d/revert-rsa-keygen-hardening.txt new file mode 100644 index 0000000000..2c8bacab28 --- /dev/null +++ b/ChangeLog.d/revert-rsa-keygen-hardening.txt @@ -0,0 +1,4 @@ +Bugfix + * Revert hardening of RSA keygen introduced in the previous release, that + caused an unacceptable performance regression on platforms with higher + memory latency. #10830