From c61ced5ec50fc68707c7cea79f7df1d170f03f13 Mon Sep 17 00:00:00 2001 From: Billy Brumley Date: Wed, 1 Apr 2020 21:15:58 +0300 Subject: [crypto/ec] blind coordinates in ec_wNAF_mul for robustness Reviewed-by: Bernd Edlinger Reviewed-by: Nicola Tuveri (Merged from https://github.com/openssl/openssl/pull/11439) --- crypto/ec/ec_mult.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'crypto/ec/ec_mult.c') diff --git a/crypto/ec/ec_mult.c b/crypto/ec/ec_mult.c index 2d3fc50acf..c66276efce 100644 --- a/crypto/ec/ec_mult.c +++ b/crypto/ec/ec_mult.c @@ -746,6 +746,20 @@ int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar, if (r_is_at_infinity) { if (!EC_POINT_copy(r, val_sub[i][digit >> 1])) goto err; + + /*- + * Apply coordinate blinding for EC_POINT. + * + * The underlying EC_METHOD can optionally implement this function: + * ec_point_blind_coordinates() returns 0 in case of errors or 1 on + * success or if coordinate blinding is not implemented for this + * group. + */ + if (!ec_point_blind_coordinates(group, r, ctx)) { + ECerr(EC_F_EC_WNAF_MUL, EC_R_POINT_COORDINATES_BLIND_FAILURE); + goto err; + } + r_is_at_infinity = 0; } else { if (!EC_POINT_add -- cgit v1.2.3