Skip to content

Constant time hardening #11159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stenslae wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Constant time hardening #11159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5df8022
F-7427: Remove WOLFSSL_MP_INVMOD_CONSTANT_TIME macro
Aug 12, 2026
0d9994d
F-7097: Route secret ECC scalars around the fixed-point cache
Aug 12, 2026
0fa0b1d
F-7098: Use Fermat exponentiation instead of mp_invmod for ECCSI signing
Aug 12, 2026
024fcd1
F-7099: Use Fermat exponentiation instead of mp_invmod for SAKKE RSK …
Aug 12, 2026
c87338e
F-7426: Implement heap-math CT primitives using branchless masks
Aug 12, 2026
23cc479
Refactor to enforce ConstantCompare across codebase and optimize with…
Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35104,8 +35104,8 @@ static int DoServerKeyExchange(WOLFSSL* ssl, const byte* input,
ssl->buffers.digest.length,
TypeHash(ssl->options.peerHashAlgo));
if (encSigSz != args->sigSz || !args->output ||
XMEMCMP(args->output, encodedSig,
min(encSigSz,
ConstantCompare(args->output, encodedSig,
(int)min(encSigSz,
MAX_ENCODED_CLASSIC_SIG_SZ))
!= 0) {
ret = VERIFY_SIGN_ERROR;
Expand All @@ -35118,7 +35118,7 @@ static int DoServerKeyExchange(WOLFSSL* ssl, const byte* input,
}
else if (args->sigSz != FINISHED_SZ ||
!args->output ||
XMEMCMP(args->output,
ConstantCompare(args->output,
ssl->buffers.digest.buffer,
FINISHED_SZ) != 0) {
ERROR_OUT(VERIFY_SIGN_ERROR, exit_dske);
Expand Down Expand Up @@ -40863,8 +40863,8 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
TypeHash(ssl->options.peerHashAlgo));

if (args->sendSz != args->sigSz || !args->output ||
XMEMCMP(args->output, encodedSig,
min(args->sigSz, MAX_ENCODED_CLASSIC_SIG_SZ)) != 0) {
ConstantCompare(args->output, encodedSig,
(int)min(args->sigSz, MAX_ENCODED_CLASSIC_SIG_SZ)) != 0) {
ret = VERIFY_CERT_ERROR;
}

Expand All @@ -40874,8 +40874,9 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
}
else {
if (args->sendSz != FINISHED_SZ || !args->output ||
XMEMCMP(args->output,
&ssl->hsHashes->certHashes, FINISHED_SZ) != 0) {
ConstantCompare(args->output,
(const byte*)&ssl->hsHashes->certHashes,
FINISHED_SZ) != 0) {
ret = VERIFY_CERT_ERROR;
}
}
Expand Down
4 changes: 2 additions & 2 deletions wolfcrypt/src/asn.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18325,8 +18325,8 @@ int ConfirmSignature(SignatureCtx* sigCtx,
sigCtx->digest, (word32)sigCtx->digestSz,
sigCtx->typeH);
if (encodedSigSz == verifySz && sigCtx->out != NULL &&
XMEMCMP(sigCtx->out, encodedSig,
(size_t)encodedSigSz) == 0) {
ConstantCompare(sigCtx->out, encodedSig,
encodedSigSz) == 0) {
ret = 0;
}
else {
Expand Down
72 changes: 7 additions & 65 deletions wolfcrypt/src/dsa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -775,15 +775,11 @@ int wc_DsaSign_ex(const byte* digest, word32 digestSz, byte* out, DsaKey* key,
mp_int *r = NULL;
mp_int *s = NULL;
mp_int *H = NULL;
#ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME
mp_int *b = NULL;
#endif
byte *buffer = NULL;
#else
mp_int k[1], kInv[1], r[1], s[1], H[1];
#ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME
mp_int b[1];
#endif
byte buffer[DSA_MAX_HALF_SIZE];
#endif
mp_int* qMinus1;
Expand All @@ -807,35 +803,26 @@ int wc_DsaSign_ex(const byte* digest, word32 digestSz, byte* out, DsaKey* key,
r = (mp_int *)XMALLOC(sizeof *r, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
s = (mp_int *)XMALLOC(sizeof *s, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
H = (mp_int *)XMALLOC(sizeof *H, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
#ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME
b = (mp_int *)XMALLOC(sizeof *b, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
#endif
buffer = (byte *)XMALLOC(DSA_MAX_HALF_SIZE, key->heap,
DYNAMIC_TYPE_TMP_BUFFER);

if ((k == NULL) ||
(kInv == NULL) ||
(r == NULL) ||
(s == NULL) ||
(H == NULL)
#ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME
|| (b == NULL)
#endif
|| (buffer == NULL)) {
(H == NULL) ||
(b == NULL) ||
(buffer == NULL)) {
ret = MEMORY_E;
break;
}
#endif

#ifdef WOLFSSL_MP_INVMOD_CONSTANT_TIME
if (mp_init_multi(k, kInv, r, s, H, 0) != MP_OKAY)
#else
if (mp_init_multi(k, kInv, r, s, H, b) != MP_OKAY)
#endif
{
ret = MP_INIT_E;
break;
}
if (mp_init_multi(k, kInv, r, s, H, b) != MP_OKAY) {
ret = MP_INIT_E;
break;
}

halfSz = min(DSA_MAX_HALF_SIZE, (word32)mp_unsigned_bin_size(&key->q));
/* NIST FIPS 186-4: Sections 4.1
Expand Down Expand Up @@ -896,46 +883,6 @@ int wc_DsaSign_ex(const byte* digest, word32 digestSz, byte* out, DsaKey* key,
break;
}

#ifdef WOLFSSL_MP_INVMOD_CONSTANT_TIME
/* inverse k mod q */
if (mp_invmod(k, &key->q, kInv) != MP_OKAY) {
ret = MP_INVMOD_E;
break;
}

/* generate r, r = (g exp k mod p) mod q */
if (mp_exptmod_ex(&key->g, k, key->q.used, &key->p, r) != MP_OKAY) {
ret = MP_EXPTMOD_E;
break;
}

if (mp_mod(r, &key->q, r) != MP_OKAY) {
ret = MP_MOD_E;
break;
}

/* generate H from sha digest */
if (mp_read_unsigned_bin(H, digest, digestSz) != MP_OKAY) {
ret = MP_READ_E;
break;
}

/* generate s, s = (kInv * (H + x*r)) % q */
if (mp_mul(&key->x, r, s) != MP_OKAY) {
ret = MP_MUL_E;
break;
}

if (mp_add(s, H, s) != MP_OKAY) {
ret = MP_ADD_E;
break;
}

if (mp_mulmod(s, kInv, &key->q, s) != MP_OKAY) {
ret = MP_MULMOD_E;
break;
}
#else
/* Blinding value
* Generate b in range [1, q-1].
*/
Expand Down Expand Up @@ -1024,7 +971,6 @@ int wc_DsaSign_ex(const byte* digest, word32 digestSz, byte* out, DsaKey* key,
ret = MP_MOD_E;
break;
}
#endif

/* detect zero r or s */
if ((mp_iszero(r) == MP_YES) || (mp_iszero(s) == MP_YES)) {
Expand Down Expand Up @@ -1074,14 +1020,12 @@ int wc_DsaSign_ex(const byte* digest, word32 digestSz, byte* out, DsaKey* key,
mp_clear(H);
XFREE(H, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
}
#ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME
if (b) {
if ((ret != WC_NO_ERR_TRACE(MP_INIT_E)) &&
(ret != WC_NO_ERR_TRACE(MEMORY_E)))
mp_forcezero(b);
XFREE(b, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
}
#endif
if (buffer) {
ForceZero(buffer, halfSz);
XFREE(buffer, key->heap, DYNAMIC_TYPE_TMP_BUFFER);
Expand All @@ -1091,9 +1035,7 @@ int wc_DsaSign_ex(const byte* digest, word32 digestSz, byte* out, DsaKey* key,
ForceZero(buffer, halfSz);
mp_forcezero(kInv);
mp_forcezero(k);
#ifndef WOLFSSL_MP_INVMOD_CONSTANT_TIME
mp_forcezero(b);
#endif
mp_clear(H);
mp_clear(s);
mp_clear(r);
Expand Down
31 changes: 30 additions & 1 deletion wolfcrypt/src/ecc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13780,7 +13780,9 @@ static int build_lut(int idx, mp_int* a, mp_int* modulus, mp_digit mp,
return err;
}

/* perform a fixed point ECC mulmod */
#ifndef ECC_TIMING_RESISTANT

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [Low] build_lut/lut_orders become unused and the FP cache becomes dead weight when ECC_TIMING_RESISTANT is set without… · Dead/unreachable code

With FP_ECC + ECC_TIMING_RESISTANT and ECC_SHAMIR undefined, every call site of build_lut (ecc.c:14477, 14651, and the fp_ecc_mul2add sites) is compiled out, leaving build_lut and the lut_orders table with no users — -Wunused-function/-Wunused-const-variable breaks -Werror builds. add_entry still allocates 2^FP_LUT ecc_points per cache entry that are never populated or read.

Fix: Guard build_lut/lut_orders with #if !defined(ECC_TIMING_RESISTANT) || defined(ECC_SHAMIR) and skip the fp-cache entry allocation when no LUT consumer is compiled in.

/* perform a fixed point ECC mulmod. Not constant-time; do not use with
* secret scalars. */
static int accel_fp_mul(int idx, const mp_int* k, ecc_point *R, mp_int* a,
mp_int* modulus, mp_digit mp, int map)
{
Expand Down Expand Up @@ -13960,6 +13962,7 @@ static int accel_fp_mul(int idx, const mp_int* k, ecc_point *R, mp_int* a,

return err;
}
#endif /* !ECC_TIMING_RESISTANT */
#endif

#ifdef ECC_SHAMIR
Expand Down Expand Up @@ -14456,6 +14459,7 @@ int wc_ecc_mulmod_ex(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
}


#ifndef ECC_TIMING_RESISTANT
Comment thread
stenslae marked this conversation as resolved.
Comment thread
stenslae marked this conversation as resolved.
if (err == MP_OKAY) {
/* if it's 2 build the LUT, if it's higher just use the LUT */
if (idx >= 0 && fp_cache[idx].lru_count >= 2 && !fp_cache[idx].LUT_set) {
Expand Down Expand Up @@ -14486,6 +14490,15 @@ int wc_ecc_mulmod_ex(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
err = normal_ecc_mulmod(k, G, R, a, modulus, NULL, map, heap);
}
}
#else
/* No RNG here, so FP-cache LUT can't be blinded; skip building/using
* it and always take the constant-time ladder. */
if (err == MP_OKAY) {
err = normal_ecc_mulmod(k, G, R, a, modulus, NULL, map, heap);
}
#endif
(void)mp;
(void)mpSetup;

out:

Expand Down Expand Up @@ -14615,6 +14628,12 @@ int wc_ecc_mulmod_ex2(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
}


#if !defined(ECC_TIMING_RESISTANT) || defined(ECC_SHAMIR)
/* Build/refresh the FP-cache LUT for this point. Needed directly by
* accel_fp_mul below when not timing-resistant, and also pre-warms
* the cache for accel_fp_mul2add's Shamir-trick path (public-scalar
* only, safe without RNG blinding), which may hit this same point
* later even when the ladder is used here. */
if (err == MP_OKAY) {
/* if it's 2 build the LUT, if it's higher just use the LUT */
if (idx >= 0 && fp_cache[idx].lru_count >= 2 && !fp_cache[idx].LUT_set) {
Expand All @@ -14632,7 +14651,16 @@ int wc_ecc_mulmod_ex2(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
err = build_lut(idx, a, modulus, mp, mu);

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ [Info] wc_ecc_mulmod_ex2 builds an FP-cache LUT it never uses · Dead/unreachable code

Under ECC_TIMING_RESISTANT with ECC_SHAMIR, the retained LUT-build block runs (2^FP_LUT point ops plus one mp_invmod per LUT entry) but its result is unread in this function, which always takes normal_ecc_mulmod. fp_ecc_mul2add already builds the LUT on demand under the identical lru_count >= 2 && !LUT_set condition, so the pre-warm adds no benefit.

Fix: Skip the LUT build in wc_ecc_mulmod_ex2 under ECC_TIMING_RESISTANT and let fp_ecc_mul2add build it on demand.

}
}
Comment thread
stenslae marked this conversation as resolved.
Comment thread
stenslae marked this conversation as resolved.
#endif

#ifdef ECC_TIMING_RESISTANT
if (err == MP_OKAY) {
/* accel_fp_mul is not safe for secret scalars. Fall back to ladder. */
(void)mpSetup;
(void)mp;
err = normal_ecc_mulmod(k, G, R, a, modulus, rng, map, heap);
}
#else
if (err == MP_OKAY) {
if (idx >= 0 && fp_cache[idx].LUT_set) {
if (mpSetup == 0) {
Expand All @@ -14645,6 +14673,7 @@ int wc_ecc_mulmod_ex2(const mp_int* k, ecc_point *G, ecc_point *R, mp_int* a,
err = normal_ecc_mulmod(k, G, R, a, modulus, rng, map, heap);
}
}
#endif

out:

Expand Down
8 changes: 6 additions & 2 deletions wolfcrypt/src/eccsi.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1995,9 +1995,13 @@ int wc_SignEccsiHash(EccsiKey* key, WC_RNG* rng, enum wc_HashType hashType,
err = eccsi_gen_sig(key, rng, hashType, msg, msgSz, r, s);
}

/* Step 5: s' = ( (( HE + r * SSK )^-1) * j ) modulo q, erase j */
/* Step 5: s' = ( (( HE + r * SSK )^-1) * j ) modulo q, erase j
* Invert via Fermat's little theorem (s^(order-2) mod order) */
if (err == 0) {
err = mp_invmod(s, &key->params.order, s);
err = mp_sub_d(&key->params.order, 2, &key->tmp);
if (err == MP_OKAY) {
err = mp_exptmod(s, &key->tmp, &key->params.order, s);
}
}
if (err == 0) {
j = wc_ecc_key_get_priv(&key->pubkey);
Expand Down
Loading
Loading