From f740d717bd31e1a4b8281072b5cb3dfeb26f3273 Mon Sep 17 00:00:00 2001 From: Adam Langley Date: Fri, 4 Dec 2015 14:17:03 -0800 Subject: [PATCH] crypto/elliptic: resample private keys if out of range. The orders of the curves in crypto/elliptic are all very close to a power of two. None the less, there is a tiny bias in the private key selection. This change makes the distribution uniform by resampling in the case that a private key is >= to the order of the curve. (It also switches from using BitSize to Params().N.BitLen() because, although they're the same value here, the latter is technically the correct thing to do.) The private key sampling and nonce sampling in crypto/ecdsa don't have this issue. Fixes #11082. Change-Id: Ie2aad563209a529fa1cab522abaf5fd505c7269a Reviewed-on: https://go-review.googlesource.com/17460 Reviewed-by: Brad Fitzpatrick Run-TryBot: Brad Fitzpatrick Reviewed-by: Russ Cox --- src/crypto/elliptic/elliptic.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go index e6b59c5f43..c02df45d10 100644 --- a/src/crypto/elliptic/elliptic.go +++ b/src/crypto/elliptic/elliptic.go @@ -274,7 +274,8 @@ var mask = []byte{0xff, 0x1, 0x3, 0x7, 0xf, 0x1f, 0x3f, 0x7f} // GenerateKey returns a public/private key pair. The private key is // generated using the given reader, which must return random data. func GenerateKey(curve Curve, rand io.Reader) (priv []byte, x, y *big.Int, err error) { - bitSize := curve.Params().BitSize + N := curve.Params().N + bitSize := N.BitLen() byteLen := (bitSize + 7) >> 3 priv = make([]byte, byteLen) @@ -289,6 +290,12 @@ func GenerateKey(curve Curve, rand io.Reader) (priv []byte, x, y *big.Int, err e // This is because, in tests, rand will return all zeros and we don't // want to get the point at infinity and loop forever. priv[1] ^= 0x42 + + // If the scalar is out of range, sample another random number. + if new(big.Int).SetBytes(priv).Cmp(N) >= 0 { + continue + } + x, y = curve.ScalarBaseMult(priv) } return