Filippo Valsorda 203e59ad41 crypto/internal/nistec: reduce P-256 scalar ... Unlike the rest of nistec, the P-256 assembly doesn't use complete addition formulas, meaning that p256PointAdd[Affine]Asm won't return the correct value if the two inputs are equal. This was (undocumentedly) ignored in the scalar multiplication loops because as long as the input point is not the identity and the scalar is lower than the order of the group, the addition inputs can't be the same. As part of the math/big rewrite, we went however from always reducing the scalar to only checking its length, under the incorrect assumption that the scalar multiplication loop didn't require reduction. Added a reduction, and while at it added it in P256OrdInverse, too, to enforce a universal reduction invariant on p256OrdElement values. Note that if the input point is the infinity, the code currently still relies on undefined behavior, but that's easily tested to behave acceptably, and will be addressed in a future CL. Fixes #58647 Fixes CVE-2023-24532 (Filed with the "safe APIs like complete addition formulas are good" dept.) Change-Id: I7b2c75238440e6852be2710fad66ff1fdc4e2b24 Reviewed-on: https://go-review.googlesource.com/c/go/+/471255 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Damien Neil <dneil@google.com>		2023-02-24 21:59:42 +00:00
..
aes	crypto/aes: On ppc64le, use better instructions when available	2022-11-21 15:06:26 +00:00
boring	crypto/internal/boring: update to newer boringcrypto, add arm64	2022-08-18 21:28:09 +00:00
cipher	crypto: use bytes.Clone	2022-09-28 03:55:33 +00:00
des	crypto/des: fix a typo in the comment for permuteFinalBlock	2022-12-01 21:00:43 +00:00
dsa
ecdh	crypto/ecdh: explicitly reject mismatched curves in ECDH	2023-02-06 21:22:50 +00:00
ecdsa	crypto/ecdsa: verify validity of signature parameters in Verify	2022-12-01 17:28:18 +00:00
ed25519	crypto/ed25519: improve Ed25519ctx docs and add example	2023-01-17 16:25:39 +00:00
elliptic	crypto/elliptic: remove deprecation markers	2022-11-24 03:05:33 +00:00
hmac	all: boringcrypto post-merge cleanup	2022-06-06 19:10:07 +00:00
internal	crypto/internal/nistec: reduce P-256 scalar	2023-02-24 21:59:42 +00:00
md5	crypto: use encoding append functions	2022-09-20 02:58:09 +00:00
rand	crypto/rand: replace shift with constant	2023-02-06 18:03:38 +00:00
rc4	crypto/internal/subtle: rename to crypto/internal/alias	2022-08-17 18:46:05 +00:00
rsa	crypto/internal/bigmod: flag amd64 assembly as noescape	2023-02-15 22:00:58 +00:00
sha1	crypto/sha1: use math/bits.RotateLeft32	2023-02-06 18:37:22 +00:00
sha256	crypto/{sha512,sha256,sha1}: reduce Write calls in Sum	2022-11-21 22:16:06 +00:00
sha512	crypto/sha512: reduce add usage on PPC64	2023-01-30 14:01:05 +00:00
subtle	crypto/subtle: add XORBytes	2022-08-17 18:47:33 +00:00
tls	crypto/tls: replace all usages of BytesOrPanic	2023-02-14 16:52:30 +00:00
x509	internal/godebug: export non-default-behavior counters in runtime/metrics	2023-01-19 22:26:43 +00:00
crypto.go	all: gofmt main repo	2022-04-11 16:34:30 +00:00
issue21104_test.go