coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

ECDH: Everest: Fix private key managment (static)

Browse Source 
Wiping out our private key is OK if we're only doing ephemeral ECDH, but
our API also supports static Diffie-Hellman, where our private key is
long term and should not be wiped out on first use...

Found accidentally with the new test that try calling `calc_secret()`
again with a larger output buffer and expect the same result.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2026-03-31 10:18:08 +02:00
parent f34f6138ca
commit fbabe53462
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
3rdparty/everest/library/x25519.c vendored
View File

@ -131,12 +131,16 @@ int mbedtls_x25519_calc_secret( mbedtls_x25519_context *ctx, size_t *olen,
if( blen < *olen )
return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Hacl_Curve25519_crypto_scalarmult( buf, ctx->our_secret, ctx->peer_point);
/* scalarmult modifies this input, let's make a copy... */
unsigned char secret[MBEDTLS_X25519_KEY_SIZE_BYTES];
memcpy(secret, ctx->our_secret, sizeof(secret));
/* Wipe the DH secret and don't let the peer chose a small subgroup point */
mbedtls_platform_zeroize( ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES );
Hacl_Curve25519_crypto_scalarmult( buf, secret, ctx->peer_point);
if( memcmp( buf, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 )
/* Wipe the copy and don't let the peer chose a small subgroup point */
mbedtls_platform_zeroize( secret, MBEDTLS_X25519_KEY_SIZE_BYTES );
if( memcmp( buf, secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 )
return MBEDTLS_ERR_ECP_RANDOM_FAILED;
return( 0 );