450916
diff -up openssl-1.0.2k/crypto/bn/bn_div.c.rohnp-fix openssl-1.0.2k/crypto/bn/bn_div.c
450916
--- openssl-1.0.2k/crypto/bn/bn_div.c.rohnp-fix	2017-01-26 14:22:03.000000000 +0100
450916
+++ openssl-1.0.2k/crypto/bn/bn_div.c	2018-08-14 10:57:21.592518702 +0200
450916
@@ -290,6 +290,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const
450916
     wnum.neg = 0;
450916
     wnum.d = &(snum->d[loop]);
450916
     wnum.top = div_n;
450916
+    wnum.flags = BN_FLG_STATIC_DATA;
450916
     /*
450916
      * only needed when BN_ucmp messes up the values between top and max
450916
      */
450916
diff -up openssl-1.0.2k/crypto/bn/bn_exp.c.rohnp-fix openssl-1.0.2k/crypto/bn/bn_exp.c
450916
--- openssl-1.0.2k/crypto/bn/bn_exp.c.rohnp-fix	2017-01-26 14:22:03.000000000 +0100
450916
+++ openssl-1.0.2k/crypto/bn/bn_exp.c	2018-08-14 10:57:21.596518798 +0200
450916
@@ -466,17 +466,17 @@ int BN_mod_exp_mont(BIGNUM *rr, const BI
450916
         ret = 1;
450916
         goto err;
450916
     }
450916
-    if (!BN_to_montgomery(val[0], aa, mont, ctx))
450916
+    if (!bn_to_mont_fixed_top(val[0], aa, mont, ctx))
450916
         goto err;               /* 1 */
450916
 
450916
     window = BN_window_bits_for_exponent_size(bits);
450916
     if (window > 1) {
450916
-        if (!BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx))
450916
+        if (!bn_mul_mont_fixed_top(d, val[0], val[0], mont, ctx))
450916
             goto err;           /* 2 */
450916
         j = 1 << (window - 1);
450916
         for (i = 1; i < j; i++) {
450916
             if (((val[i] = BN_CTX_get(ctx)) == NULL) ||
450916
-                !BN_mod_mul_montgomery(val[i], val[i - 1], d, mont, ctx))
450916
+                !bn_mul_mont_fixed_top(val[i], val[i - 1], d, mont, ctx))
450916
                 goto err;
450916
         }
450916
     }
450916
@@ -498,19 +498,15 @@ int BN_mod_exp_mont(BIGNUM *rr, const BI
450916
         for (i = 1; i < j; i++)
450916
             r->d[i] = (~m->d[i]) & BN_MASK2;
450916
         r->top = j;
450916
-        /*
450916
-         * Upper words will be zero if the corresponding words of 'm' were
450916
-         * 0xfff[...], so decrement r->top accordingly.
450916
-         */
450916
-        bn_correct_top(r);
450916
+        r->flags |= BN_FLG_FIXED_TOP;
450916
     } else
450916
 #endif
450916
-    if (!BN_to_montgomery(r, BN_value_one(), mont, ctx))
450916
+    if (!bn_to_mont_fixed_top(r, BN_value_one(), mont, ctx))
450916
         goto err;
450916
     for (;;) {
450916
         if (BN_is_bit_set(p, wstart) == 0) {
450916
             if (!start) {
450916
-                if (!BN_mod_mul_montgomery(r, r, r, mont, ctx))
450916
+                if (!bn_mul_mont_fixed_top(r, r, r, mont, ctx))
450916
                     goto err;
450916
             }
450916
             if (wstart == 0)
450916
@@ -541,12 +537,12 @@ int BN_mod_exp_mont(BIGNUM *rr, const BI
450916
         /* add the 'bytes above' */
450916
         if (!start)
450916
             for (i = 0; i < j; i++) {
450916
-                if (!BN_mod_mul_montgomery(r, r, r, mont, ctx))
450916
+                if (!bn_mul_mont_fixed_top(r, r, r, mont, ctx))
450916
                     goto err;
450916
             }
450916
 
450916
         /* wvalue will be an odd number < 2^window */
450916
-        if (!BN_mod_mul_montgomery(r, r, val[wvalue >> 1], mont, ctx))
450916
+        if (!bn_mul_mont_fixed_top(r, r, val[wvalue >> 1], mont, ctx))
450916
             goto err;
450916
 
450916
         /* move the 'window' down further */
450916
@@ -556,6 +552,11 @@ int BN_mod_exp_mont(BIGNUM *rr, const BI
450916
         if (wstart < 0)
450916
             break;
450916
     }
450916
+    /*
450916
+     * Done with zero-padded intermediate BIGNUMs. Final BN_from_montgomery
450916
+     * removes padding [if any] and makes return value suitable for public
450916
+     * API consumer.
450916
+     */
450916
 #if defined(SPARC_T4_MONT)
450916
     if (OPENSSL_sparcv9cap_P[0] & (SPARCV9_VIS3 | SPARCV9_PREFER_FPU)) {
450916
         j = mont->N.top;        /* borrow j */
450916
@@ -674,7 +675,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBU
450916
     }
450916
 
450916
     b->top = top;
450916
-    bn_correct_top(b);
450916
+    b->flags |= BN_FLG_FIXED_TOP;
450916
     return 1;
450916
 }
450916
 
450916
@@ -841,16 +842,16 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
450916
         tmp.top = top;
450916
     } else
450916
 #endif
450916
-    if (!BN_to_montgomery(&tmp, BN_value_one(), mont, ctx))
450916
+    if (!bn_to_mont_fixed_top(&tmp, BN_value_one(), mont, ctx))
450916
         goto err;
450916
 
450916
     /* prepare a^1 in Montgomery domain */
450916
     if (a->neg || BN_ucmp(a, m) >= 0) {
450916
         if (!BN_mod(&am, a, m, ctx))
450916
             goto err;
450916
-        if (!BN_to_montgomery(&am, &am, mont, ctx))
450916
+        if (!bn_to_mont_fixed_top(&am, &am, mont, ctx))
450916
             goto err;
450916
-    } else if (!BN_to_montgomery(&am, a, mont, ctx))
450916
+    } else if (!bn_to_mont_fixed_top(&am, a, mont, ctx))
450916
         goto err;
450916
 
450916
 #if defined(SPARC_T4_MONT)
450916
@@ -1117,14 +1118,14 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
450916
          * performance advantage of sqr over mul).
450916
          */
450916
         if (window > 1) {
450916
-            if (!BN_mod_mul_montgomery(&tmp, &am, &am, mont, ctx))
450916
+            if (!bn_mul_mont_fixed_top(&tmp, &am, &am, mont, ctx))
450916
                 goto err;
450916
             if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, 2,
450916
                                               window))
450916
                 goto err;
450916
             for (i = 3; i < numPowers; i++) {
450916
                 /* Calculate a^i = a^(i-1) * a */
450916
-                if (!BN_mod_mul_montgomery(&tmp, &am, &tmp, mont, ctx))
450916
+                if (!bn_mul_mont_fixed_top(&tmp, &am, &tmp, mont, ctx))
450916
                     goto err;
450916
                 if (!MOD_EXP_CTIME_COPY_TO_PREBUF(&tmp, top, powerbuf, i,
450916
                                                   window))
450916
@@ -1148,7 +1149,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
450916
 
450916
             /* Scan the window, squaring the result as we go */
450916
             for (i = 0; i < window; i++, bits--) {
450916
-                if (!BN_mod_mul_montgomery(&tmp, &tmp, &tmp, mont, ctx))
450916
+                if (!bn_mul_mont_fixed_top(&tmp, &tmp, &tmp, mont, ctx))
450916
                     goto err;
450916
                 wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);
450916
             }
450916
@@ -1161,12 +1162,16 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr
450916
                 goto err;
450916
 
450916
             /* Multiply the result into the intermediate result */
450916
-            if (!BN_mod_mul_montgomery(&tmp, &tmp, &am, mont, ctx))
450916
+            if (!bn_mul_mont_fixed_top(&tmp, &tmp, &am, mont, ctx))
450916
                 goto err;
450916
         }
450916
     }
450916
 
450916
-    /* Convert the final result from montgomery to standard format */
450916
+    /*
450916
+     * Done with zero-padded intermediate BIGNUMs. Final BN_from_montgomery
450916
+     * removes padding [if any] and makes return value suitable for public
450916
+     * API consumer.
450916
+     */
450916
 #if defined(SPARC_T4_MONT)
450916
     if (OPENSSL_sparcv9cap_P[0] & (SPARCV9_VIS3 | SPARCV9_PREFER_FPU)) {
450916
         am.d[0] = 1;            /* borrow am */
450916
diff -up openssl-1.0.2k/crypto/bn/bn.h.rohnp-fix openssl-1.0.2k/crypto/bn/bn.h
450916
--- openssl-1.0.2k/crypto/bn/bn.h.rohnp-fix	2018-06-20 17:44:01.752387208 +0200
450916
+++ openssl-1.0.2k/crypto/bn/bn.h	2018-08-14 10:57:21.592518702 +0200
450916
@@ -702,6 +702,16 @@ BIGNUM *bn_dup_expand(const BIGNUM *a, i
450916
 /* We only need assert() when debugging */
450916
 #  include <assert.h>
450916
 
450916
+/*
450916
+ * The new BN_FLG_FIXED_TOP flag marks vectors that were not treated with
450916
+ * bn_correct_top, in other words such vectors are permitted to have zeros
450916
+ * in most significant limbs. Such vectors are used internally to achieve
450916
+ * execution time invariance for critical operations with private keys.
450916
+ * It's BN_DEBUG-only flag, because user application is not supposed to
450916
+ * observe it anyway. Moreover, optimizing compiler would actually remove
450916
+ * all operations manipulating the bit in question in non-BN_DEBUG build.
450916
+ */
450916
+#  define BN_FLG_FIXED_TOP 0x10000
450916
 #  ifdef BN_DEBUG_RAND
450916
 /* To avoid "make update" cvs wars due to BN_DEBUG, use some tricks */
450916
 #   ifndef RAND_pseudo_bytes
450916
@@ -734,8 +744,10 @@ int RAND_pseudo_bytes(unsigned char *buf
450916
         do { \
450916
                 const BIGNUM *_bnum2 = (a); \
450916
                 if (_bnum2 != NULL) { \
450916
-                        assert((_bnum2->top == 0) || \
450916
-                                (_bnum2->d[_bnum2->top - 1] != 0)); \
450916
+                        int _top = _bnum2->top; \
450916
+                        assert((_top == 0) || \
450916
+                               (_bnum2->flags & BN_FLG_FIXED_TOP) || \
450916
+                               (_bnum2->d[_top - 1] != 0)); \
450916
                         bn_pollute(_bnum2); \
450916
                 } \
450916
         } while(0)
450916
@@ -753,6 +765,7 @@ int RAND_pseudo_bytes(unsigned char *buf
450916
 
450916
 # else                          /* !BN_DEBUG */
450916
 
450916
+#  define BN_FLG_FIXED_TOP 0
450916
 #  define bn_pollute(a)
450916
 #  define bn_check_top(a)
450916
 #  define bn_fix_top(a)           bn_correct_top(a)
450916
diff -up openssl-1.0.2k/crypto/bn/bn_lcl.h.rohnp-fix openssl-1.0.2k/crypto/bn/bn_lcl.h
450916
--- openssl-1.0.2k/crypto/bn/bn_lcl.h.rohnp-fix	2018-06-20 17:44:01.748387114 +0200
450916
+++ openssl-1.0.2k/crypto/bn/bn_lcl.h	2018-08-14 10:57:21.596518798 +0200
450916
@@ -113,6 +113,7 @@
450916
 # define HEADER_BN_LCL_H
450916
 
450916
 # include <openssl/bn.h>
450916
+# include "bn_int.h"
450916
 
450916
 #ifdef  __cplusplus
450916
 extern "C" {
450916
diff -up openssl-1.0.2k/crypto/bn/bn_lib.c.rohnp-fix openssl-1.0.2k/crypto/bn/bn_lib.c
450916
--- openssl-1.0.2k/crypto/bn/bn_lib.c.rohnp-fix	2017-01-26 14:22:03.000000000 +0100
450916
+++ openssl-1.0.2k/crypto/bn/bn_lib.c	2018-08-14 10:57:21.592518702 +0200
450916
@@ -290,8 +290,6 @@ static BN_ULONG *bn_expand_internal(cons
450916
     const BN_ULONG *B;
450916
     int i;
450916
 
450916
-    bn_check_top(b);
450916
-
450916
     if (words > (INT_MAX / (4 * BN_BITS2))) {
450916
         BNerr(BN_F_BN_EXPAND_INTERNAL, BN_R_BIGNUM_TOO_LONG);
450916
         return NULL;
450916
@@ -425,8 +423,6 @@ BIGNUM *bn_dup_expand(const BIGNUM *b, i
450916
 
450916
 BIGNUM *bn_expand2(BIGNUM *b, int words)
450916
 {
450916
-    bn_check_top(b);
450916
-
450916
     if (words > b->dmax) {
450916
         BN_ULONG *a = bn_expand_internal(b, words);
450916
         if (!a)
450916
@@ -460,7 +456,6 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
450916
         assert(A == &(b->d[b->dmax]));
450916
     }
450916
 #endif
450916
-    bn_check_top(b);
450916
     return b;
450916
 }
450916
 
450916
@@ -572,6 +567,7 @@ void BN_clear(BIGNUM *a)
450916
         OPENSSL_cleanse(a->d, a->dmax * sizeof(a->d[0]));
450916
     a->top = 0;
450916
     a->neg = 0;
450916
+    a->flags &= ~BN_FLG_FIXED_TOP;
450916
 }
450916
 
450916
 BN_ULONG BN_get_word(const BIGNUM *a)
450916
@@ -592,6 +588,7 @@ int BN_set_word(BIGNUM *a, BN_ULONG w)
450916
     a->neg = 0;
450916
     a->d[0] = w;
450916
     a->top = (w ? 1 : 0);
450916
+    a->flags &= ~BN_FLG_FIXED_TOP;
450916
     bn_check_top(a);
450916
     return (1);
450916
 }
450916
@@ -738,6 +735,7 @@ int BN_set_bit(BIGNUM *a, int n)
450916
         for (k = a->top; k < i + 1; k++)
450916
             a->d[k] = 0;
450916
         a->top = i + 1;
450916
+        a->flags &= ~BN_FLG_FIXED_TOP;
450916
     }
450916
 
450916
     a->d[i] |= (((BN_ULONG)1) << j);
450916
diff -up openssl-1.0.2k/crypto/bn/bn_mod.c.rohnp-fix openssl-1.0.2k/crypto/bn/bn_mod.c
450916
--- openssl-1.0.2k/crypto/bn/bn_mod.c.rohnp-fix	2017-01-26 14:22:03.000000000 +0100
450916
+++ openssl-1.0.2k/crypto/bn/bn_mod.c	2018-08-14 10:57:21.601518919 +0200
450916
@@ -149,18 +149,73 @@ int BN_mod_add(BIGNUM *r, const BIGNUM *
450916
 
450916
 /*
450916
  * BN_mod_add variant that may be used if both a and b are non-negative and
450916
- * less than m
450916
+ * less than m. The original algorithm was
450916
+ *
450916
+ *    if (!BN_uadd(r, a, b))
450916
+ *       return 0;
450916
+ *    if (BN_ucmp(r, m) >= 0)
450916
+ *       return BN_usub(r, r, m);
450916
+ *
450916
+ * which is replaced with addition, subtracting modulus, and conditional
450916
+ * move depending on whether or not subtraction borrowed.
450916
  */
450916
-int BN_mod_add_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
-                     const BIGNUM *m)
450916
+int bn_mod_add_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
+                         const BIGNUM *m)
450916
 {
450916
-    if (!BN_uadd(r, a, b))
450916
+    size_t i, ai, bi, mtop = m->top;
450916
+    BN_ULONG storage[1024 / BN_BITS2];
450916
+    BN_ULONG carry, temp, mask, *rp, *tp = storage;
450916
+    const BN_ULONG *ap, *bp;
450916
+
450916
+    if (bn_wexpand(r, m->top) == NULL)
450916
         return 0;
450916
-    if (BN_ucmp(r, m) >= 0)
450916
-        return BN_usub(r, r, m);
450916
+
450916
+    if (mtop > sizeof(storage) / sizeof(storage[0])
450916
+        && (tp = OPENSSL_malloc(mtop * sizeof(BN_ULONG))) == NULL)
450916
+	return 0;
450916
+
450916
+    ap = a->d != NULL ? a->d : tp;
450916
+    bp = b->d != NULL ? b->d : tp;
450916
+
450916
+    for (i = 0, ai = 0, bi = 0, carry = 0; i < mtop;) {
450916
+        mask = (BN_ULONG)0 - ((i - a->top) >> (8 * sizeof(i) - 1));
450916
+        temp = ((ap[ai] & mask) + carry) & BN_MASK2;
450916
+        carry = (temp < carry);
450916
+
450916
+        mask = (BN_ULONG)0 - ((i - b->top) >> (8 * sizeof(i) - 1));
450916
+        tp[i] = ((bp[bi] & mask) + temp) & BN_MASK2;
450916
+        carry += (tp[i] < temp);
450916
+
450916
+        i++;
450916
+        ai += (i - a->dmax) >> (8 * sizeof(i) - 1);
450916
+        bi += (i - b->dmax) >> (8 * sizeof(i) - 1);
450916
+    }
450916
+    rp = r->d;
450916
+    carry -= bn_sub_words(rp, tp, m->d, mtop);
450916
+    for (i = 0; i < mtop; i++) {
450916
+        rp[i] = (carry & tp[i]) | (~carry & rp[i]);
450916
+        ((volatile BN_ULONG *)tp)[i] = 0;
450916
+    }
450916
+    r->top = mtop;
450916
+    r->neg = 0;
450916
+
450916
+    if (tp != storage)
450916
+        OPENSSL_free(tp);
450916
+
450916
     return 1;
450916
 }
450916
 
450916
+int BN_mod_add_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
+                     const BIGNUM *m)
450916
+{
450916
+    int ret = bn_mod_add_fixed_top(r, a, b, m);
450916
+
450916
+    if (ret)
450916
+        bn_correct_top(r);
450916
+
450916
+    return ret;
450916
+}
450916
+
450916
 int BN_mod_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
450916
                BN_CTX *ctx)
450916
 {
450916
diff -up openssl-1.0.2k/crypto/bn/bn_mont.c.rohnp-fix openssl-1.0.2k/crypto/bn/bn_mont.c
450916
--- openssl-1.0.2k/crypto/bn/bn_mont.c.rohnp-fix	2018-08-14 10:57:21.589518629 +0200
450916
+++ openssl-1.0.2k/crypto/bn/bn_mont.c	2018-08-14 11:15:11.425320301 +0200
450916
@@ -56,7 +56,7 @@
450916
  * [including the GNU Public Licence.]
450916
  */
450916
 /* ====================================================================
450916
- * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
450916
+ * Copyright (c) 1998-2018 The OpenSSL Project.  All rights reserved.
450916
  *
450916
  * Redistribution and use in source and binary forms, with or without
450916
  * modification, are permitted provided that the following conditions
450916
@@ -123,12 +123,23 @@
450916
 #define MONT_WORD               /* use the faster word-based algorithm */
450916
 
450916
 #ifdef MONT_WORD
450916
-static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont);
450916
+static int bn_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont);
450916
 #endif
450916
 
450916
 int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
                           BN_MONT_CTX *mont, BN_CTX *ctx)
450916
 {
450916
+    int ret = bn_mul_mont_fixed_top(r, a, b, mont, ctx);
450916
+
450916
+    bn_correct_top(r);
450916
+    bn_check_top(r);
450916
+
450916
+    return ret;
450916
+}
450916
+
450916
+int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
+                          BN_MONT_CTX *mont, BN_CTX *ctx)
450916
+{
450916
     BIGNUM *tmp;
450916
     int ret = 0;
450916
 #if defined(OPENSSL_BN_ASM_MONT) && defined(MONT_WORD)
450916
@@ -140,8 +151,8 @@ int BN_mod_mul_montgomery(BIGNUM *r, con
450916
         if (bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num)) {
450916
             r->neg = a->neg ^ b->neg;
450916
             r->top = num;
450916
-            bn_correct_top(r);
450916
-            return (1);
450916
+            r->flags |= BN_FLG_FIXED_TOP;
450916
+            return 1;
450916
         }
450916
     }
450916
 #endif
450916
@@ -161,13 +172,12 @@ int BN_mod_mul_montgomery(BIGNUM *r, con
450916
     }
450916
     /* reduce from aRR to aR */
450916
 #ifdef MONT_WORD
450916
-    if (!BN_from_montgomery_word(r, tmp, mont))
450916
+    if (!bn_from_montgomery_word(r, tmp, mont))
450916
         goto err;
450916
 #else
450916
     if (!BN_from_montgomery(r, tmp, mont, ctx))
450916
         goto err;
450916
 #endif
450916
-    bn_check_top(r);
450916
     ret = 1;
450916
  err:
450916
     BN_CTX_end(ctx);
450916
@@ -175,7 +185,7 @@ int BN_mod_mul_montgomery(BIGNUM *r, con
450916
 }
450916
 
450916
 #ifdef MONT_WORD
450916
-static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
450916
+static int bn_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
450916
 {
450916
     BIGNUM *n;
450916
     BN_ULONG *ap, *np, *rp, n0, v, carry;
450916
@@ -205,28 +215,16 @@ static int BN_from_montgomery_word(BIGNU
450916
 # endif
450916
 
450916
     r->top = max;
450916
+    r->flags |= BN_FLG_FIXED_TOP;
450916
     n0 = mont->n0[0];
450916
 
450916
-# ifdef BN_COUNT
450916
-    fprintf(stderr, "word BN_from_montgomery_word %d * %d\n", nl, nl);
450916
-# endif
450916
+    /*
450916
+     * Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On
450916
+     * input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r|
450916
+     * includes |carry| which is stored separately.
450916
+     */
450916
     for (carry = 0, i = 0; i < nl; i++, rp++) {
450916
-# ifdef __TANDEM
450916
-        {
450916
-            long long t1;
450916
-            long long t2;
450916
-            long long t3;
450916
-            t1 = rp[0] * (n0 & 0177777);
450916
-            t2 = 037777600000l;
450916
-            t2 = n0 & t2;
450916
-            t3 = rp[0] & 0177777;
450916
-            t2 = (t3 * t2) & BN_MASK2;
450916
-            t1 = t1 + t2;
450916
-            v = bn_mul_add_words(rp, np, nl, (BN_ULONG)t1);
450916
-        }
450916
-# else
450916
         v = bn_mul_add_words(rp, np, nl, (rp[0] * n0) & BN_MASK2);
450916
-# endif
450916
         v = (v + carry + rp[nl]) & BN_MASK2;
450916
         carry |= (v != rp[nl]);
450916
         carry &= (v <= rp[nl]);
450916
@@ -236,52 +234,27 @@ static int BN_from_montgomery_word(BIGNU
450916
     if (bn_wexpand(ret, nl) == NULL)
450916
         return (0);
450916
     ret->top = nl;
450916
+    ret->flags |= BN_FLG_FIXED_TOP;
450916
     ret->neg = r->neg;
450916
 
450916
     rp = ret->d;
450916
-    ap = &(r->d[nl]);
450916
 
450916
-# define BRANCH_FREE 1
450916
-# if BRANCH_FREE
450916
-    {
450916
-        BN_ULONG *nrp;
450916
-        size_t m;
450916
+    /*
450916
+     * Shift |nl| words to divide by R. We have |ap| < 2 * |n|. Note that |ap|
450916
+     * includes |carry| which is stored separately.
450916
+     */
450916
+    ap = &(r->d[nl]);
450916
 
450916
-        v = bn_sub_words(rp, ap, np, nl) - carry;
450916
-        /*
450916
-         * if subtraction result is real, then trick unconditional memcpy
450916
-         * below to perform in-place "refresh" instead of actual copy.
450916
-         */
450916
-        m = (0 - (size_t)v);
450916
-        nrp =
450916
-            (BN_ULONG *)(((PTR_SIZE_INT) rp & ~m) | ((PTR_SIZE_INT) ap & m));
450916
-
450916
-        for (i = 0, nl -= 4; i < nl; i += 4) {
450916
-            BN_ULONG t1, t2, t3, t4;
450916
-
450916
-            t1 = nrp[i + 0];
450916
-            t2 = nrp[i + 1];
450916
-            t3 = nrp[i + 2];
450916
-            ap[i + 0] = 0;
450916
-            t4 = nrp[i + 3];
450916
-            ap[i + 1] = 0;
450916
-            rp[i + 0] = t1;
450916
-            ap[i + 2] = 0;
450916
-            rp[i + 1] = t2;
450916
-            ap[i + 3] = 0;
450916
-            rp[i + 2] = t3;
450916
-            rp[i + 3] = t4;
450916
-        }
450916
-        for (nl += 4; i < nl; i++)
450916
-            rp[i] = nrp[i], ap[i] = 0;
450916
+    carry -= bn_sub_words(rp, ap, np, nl);
450916
+    /*
450916
+     * |carry| is -1 if |ap| - |np| underflowed or zero if it did not. Note
450916
+     * |carry| cannot be 1. That would imply the subtraction did not fit in
450916
+     * |nl| words, and we know at most one subtraction is needed.
450916
+     */
450916
+    for (i = 0; i < nl; i++) {
450916
+        rp[i] = (carry & ap[i]) | (~carry & rp[i]);
450916
+        ap[i] = 0;
450916
     }
450916
-# else
450916
-    if (bn_sub_words(rp, ap, np, nl) - carry)
450916
-        memcpy(rp, ap, nl * sizeof(BN_ULONG));
450916
-# endif
450916
-    bn_correct_top(r);
450916
-    bn_correct_top(ret);
450916
-    bn_check_top(ret);
450916
 
450916
     return (1);
450916
 }
450916
@@ -295,8 +268,11 @@ int BN_from_montgomery(BIGNUM *ret, cons
450916
     BIGNUM *t;
450916
 
450916
     BN_CTX_start(ctx);
450916
-    if ((t = BN_CTX_get(ctx)) && BN_copy(t, a))
450916
-        retn = BN_from_montgomery_word(ret, t, mont);
450916
+    if ((t = BN_CTX_get(ctx)) && BN_copy(t, a)) {
450916
+        retn = bn_from_montgomery_word(ret, t, mont);
450916
+        bn_correct_top(ret);
450916
+        bn_check_top(ret);
450916
+    }
450916
     BN_CTX_end(ctx);
450916
 #else                           /* !MONT_WORD */
450916
     BIGNUM *t1, *t2;
450916
@@ -334,6 +310,12 @@ int BN_from_montgomery(BIGNUM *ret, cons
450916
     return (retn);
450916
 }
450916
 
450916
+int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
450916
+                         BN_CTX *ctx)
450916
+{
450916
+    return bn_mul_mont_fixed_top(r, a, &(mont->RR), mont, ctx);
450916
+}
450916
+
450916
 BN_MONT_CTX *BN_MONT_CTX_new(void)
450916
 {
450916
     BN_MONT_CTX *ret;
450916
@@ -370,7 +352,7 @@ void BN_MONT_CTX_free(BN_MONT_CTX *mont)
450916
 
450916
 int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
450916
 {
450916
-    int ret = 0;
450916
+    int i, ret = 0;
450916
     BIGNUM *Ri, *R;
450916
 
450916
     if (BN_is_zero(mod))
450916
@@ -382,6 +364,8 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, c
450916
     R = &(mont->RR);            /* grab RR as a temp */
450916
     if (!BN_copy(&(mont->N), mod))
450916
         goto err;               /* Set N */
450916
+    if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
450916
+        BN_set_flags(&(mont->N), BN_FLG_CONSTTIME);
450916
     mont->N.neg = 0;
450916
 
450916
 #ifdef MONT_WORD
450916
@@ -394,6 +378,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, c
450916
         tmod.dmax = 2;
450916
         tmod.neg = 0;
450916
 
450916
+        if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)
450916
+            BN_set_flags(&tmod, BN_FLG_CONSTTIME);
450916
+
450916
         mont->ri = (BN_num_bits(mod) + (BN_BITS2 - 1)) / BN_BITS2 * BN_BITS2;
450916
 
450916
 # if defined(OPENSSL_BN_ASM_MONT) && (BN_BITS2<=32)
450916
@@ -496,6 +483,11 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, c
450916
     if (!BN_mod(&(mont->RR), &(mont->RR), &(mont->N), ctx))
450916
         goto err;
450916
 
450916
+    for (i = mont->RR.top, ret = mont->N.top; i < ret; i++)
450916
+        mont->RR.d[i] = 0;
450916
+    mont->RR.top = ret;
450916
+    mont->RR.flags |= BN_FLG_FIXED_TOP;
450916
+
450916
     ret = 1;
450916
  err:
450916
     BN_CTX_end(ctx);
450916
diff -up openssl-1.0.2k/crypto/bn/bn_sqr.c.rohnp-fix openssl-1.0.2k/crypto/bn/bn_sqr.c
450916
--- openssl-1.0.2k/crypto/bn/bn_sqr.c.rohnp-fix	2017-01-26 14:22:03.000000000 +0100
450916
+++ openssl-1.0.2k/crypto/bn/bn_sqr.c	2018-08-14 10:57:21.593518726 +0200
450916
@@ -135,14 +135,8 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, B
450916
     }
450916
 
450916
     rr->neg = 0;
450916
-    /*
450916
-     * If the most-significant half of the top word of 'a' is zero, then the
450916
-     * square of 'a' will max-1 words.
450916
-     */
450916
-    if (a->d[al - 1] == (a->d[al - 1] & BN_MASK2l))
450916
-        rr->top = max - 1;
450916
-    else
450916
-        rr->top = max;
450916
+    rr->top = max;
450916
+    bn_correct_top(rr);
450916
     if (r != rr && BN_copy(r, rr) == NULL)
450916
         goto err;
450916
 
450916
diff -up openssl-1.0.2k/crypto/bn_int.h.rohnp-fix openssl-1.0.2k/crypto/bn_int.h
450916
--- openssl-1.0.2k/crypto/bn_int.h.rohnp-fix	2018-08-14 10:57:21.597518822 +0200
450916
+++ openssl-1.0.2k/crypto/bn_int.h	2018-08-14 10:57:21.599518871 +0200
450916
@@ -0,0 +1,13 @@
450916
+/*
450916
+ * Some BIGNUM functions assume most significant limb to be non-zero, which
450916
+ * is customarily arranged by bn_correct_top. Output from below functions
450916
+ * is not processed with bn_correct_top, and for this reason it may not be
450916
+ * returned out of public API. It may only be passed internally into other
450916
+ * functions known to support non-minimal or zero-padded BIGNUMs.
450916
+ */
450916
+int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
+                          BN_MONT_CTX *mont, BN_CTX *ctx);
450916
+int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
450916
+                         BN_CTX *ctx);
450916
+int bn_mod_add_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
450916
+                         const BIGNUM *m);
450916
diff -up openssl-1.0.2k/crypto/dsa/dsa_ossl.c.rohnp-fix openssl-1.0.2k/crypto/dsa/dsa_ossl.c
450916
--- openssl-1.0.2k/crypto/dsa/dsa_ossl.c.rohnp-fix	2018-06-20 17:44:02.153396702 +0200
450916
+++ openssl-1.0.2k/crypto/dsa/dsa_ossl.c	2018-06-20 17:44:02.577406741 +0200
450916
@@ -136,8 +136,7 @@ const DSA_METHOD *DSA_OpenSSL(void)
450916
 static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
450916
 {
450916
     BIGNUM *kinv = NULL, *r = NULL, *s = NULL;
450916
-    BIGNUM m;
450916
-    BIGNUM xr;
450916
+    BIGNUM *m, *blind, *blindm, *tmp;
450916
     BN_CTX *ctx = NULL;
450916
     int reason = ERR_R_BN_LIB;
450916
     DSA_SIG *ret = NULL;
450916
@@ -156,9 +155,6 @@ static DSA_SIG *dsa_do_sign(const unsign
450916
     }
450916
 #endif
450916
 
450916
-    BN_init(&m);
450916
-    BN_init(&xr);
450916
-
450916
     if (!dsa->p || !dsa->q || !dsa->g) {
450916
         reason = DSA_R_MISSING_PARAMETERS;
450916
         goto err;
450916
@@ -170,6 +166,14 @@ static DSA_SIG *dsa_do_sign(const unsign
450916
     ctx = BN_CTX_new();
450916
     if (ctx == NULL)
450916
         goto err;
450916
+    BN_CTX_start(ctx);
450916
+    m = BN_CTX_get(ctx);
450916
+    blind = BN_CTX_get(ctx);
450916
+    blindm = BN_CTX_get(ctx);
450916
+    tmp = BN_CTX_get(ctx);
450916
+    if (tmp == NULL)
450916
+        goto err;
450916
+
450916
  redo:
450916
     if ((dsa->kinv == NULL) || (dsa->r == NULL)) {
450916
         if (!DSA_sign_setup(dsa, ctx, &kinv, &r))
450916
@@ -189,20 +193,52 @@ static DSA_SIG *dsa_do_sign(const unsign
450916
          * 4.2
450916
          */
450916
         dlen = BN_num_bytes(dsa->q);
450916
-    if (BN_bin2bn(dgst, dlen, &m) == NULL)
450916
+    if (BN_bin2bn(dgst, dlen, m) == NULL)
450916
         goto err;
450916
 
450916
-    /* Compute  s = inv(k) (m + xr) mod q */
450916
-    if (!BN_mod_mul(&xr, dsa->priv_key, r, dsa->q, ctx))
450916
-        goto err;               /* s = xr */
450916
-    if (!BN_add(s, &xr, &m))
450916
-        goto err;               /* s = m + xr */
450916
-    if (BN_cmp(s, dsa->q) > 0)
450916
-        if (!BN_sub(s, s, dsa->q))
450916
+    /*
450916
+     * The normal signature calculation is:
450916
+     *
450916
+     *   s := k^-1 * (m + r * priv_key) mod q
450916
+     *
450916
+     * We will blind this to protect against side channel attacks
450916
+     *
450916
+     *   s := blind^-1 * k^-1 * (blind * m + blind * r * priv_key) mod q
450916
+     */
450916
+
450916
+    /* Generate a blinding value */
450916
+    do {
450916
+        if (!BN_rand(blind, BN_num_bits(dsa->q) - 1, -1, 0))
450916
             goto err;
450916
+    } while (BN_is_zero(blind));
450916
+    BN_set_flags(blind, BN_FLG_CONSTTIME);
450916
+    BN_set_flags(blindm, BN_FLG_CONSTTIME);
450916
+    BN_set_flags(tmp, BN_FLG_CONSTTIME);
450916
+
450916
+    /* tmp := blind * priv_key * r mod q */
450916
+    if (!BN_mod_mul(tmp, blind, dsa->priv_key, dsa->q, ctx))
450916
+        goto err;
450916
+    if (!BN_mod_mul(tmp, tmp, r, dsa->q, ctx))
450916
+        goto err;
450916
+
450916
+    /* blindm := blind * m mod q */
450916
+    if (!BN_mod_mul(blindm, blind, m, dsa->q, ctx))
450916
+        goto err;
450916
+
450916
+    /* s : = (blind * priv_key * r) + (blind * m) mod q */
450916
+    if (!BN_mod_add_quick(s, tmp, blindm, dsa->q))
450916
+        goto err;
450916
+
450916
+    /* s := s * k^-1 mod q */
450916
     if (!BN_mod_mul(s, s, kinv, dsa->q, ctx))
450916
         goto err;
450916
 
450916
+    /* s:= s * blind^-1 mod q */
450916
+    if (BN_mod_inverse(blind, blind, dsa->q, ctx) == NULL)
450916
+        goto err;
450916
+    if (!BN_mod_mul(s, s, blind, dsa->q, ctx))
450916
+        goto err;
450916
+
450916
     /*
450916
      * Redo if r or s is zero as required by FIPS 186-3: this is very
450916
      * unlikely.
450916
@@ -226,13 +262,12 @@ static DSA_SIG *dsa_do_sign(const unsign
450916
         BN_free(r);
450916
         BN_free(s);
450916
     }
450916
-    if (ctx != NULL)
450916
+    if (ctx != NULL) {
450916
+        BN_CTX_end(ctx);
450916
         BN_CTX_free(ctx);
450916
-    BN_clear_free(&m);
450916
-    BN_clear_free(&xr);
450916
-    if (kinv != NULL)           /* dsa->kinv is NULL now if we used it */
450916
-        BN_clear_free(kinv);
450916
-    return (ret);
450916
+    }
450916
+    BN_clear_free(kinv);
450916
+    return ret;
450916
 }
450916
 
450916
 static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
450916
diff -up openssl-1.0.2k/crypto/ecdsa/ecs_ossl.c.rohnp-fix openssl-1.0.2k/crypto/ecdsa/ecs_ossl.c
450916
--- openssl-1.0.2k/crypto/ecdsa/ecs_ossl.c.rohnp-fix	2018-06-20 17:44:02.205397934 +0200
450916
+++ openssl-1.0.2k/crypto/ecdsa/ecs_ossl.c	2018-08-14 11:18:02.062439755 +0200
450916
@@ -63,6 +63,7 @@
450916
 #ifdef OPENSSL_FIPS
450916
 # include <openssl/fips.h>
450916
 #endif
450916
+#include "bn_int.h"
450916
 
450916
 static ECDSA_SIG *ecdsa_do_sign(const unsigned char *dgst, int dlen,
450916
                                 const BIGNUM *, const BIGNUM *,
450916
@@ -98,6 +99,7 @@ static int ecdsa_sign_setup(EC_KEY *ecke
450916
     EC_POINT *tmp_point = NULL;
450916
     const EC_GROUP *group;
450916
     int ret = 0;
450916
+    int order_bits;
450916
 
450916
     if (eckey == NULL || (group = EC_KEY_get0_group(eckey)) == NULL) {
450916
         ECDSAerr(ECDSA_F_ECDSA_SIGN_SETUP, ERR_R_PASSED_NULL_PARAMETER);
450916
@@ -129,6 +131,13 @@ static int ecdsa_sign_setup(EC_KEY *ecke
450916
         goto err;
450916
     }
450916
 
450916
+    /* Preallocate space */
450916
+    order_bits = BN_num_bits(order);
450916
+    if (!BN_set_bit(k, order_bits)
450916
+        || !BN_set_bit(r, order_bits)
450916
+        || !BN_set_bit(X, order_bits))
450916
+        goto err;
450916
+
450916
     do {
450916
         /* get random k */
450916
         do
450916
@@ -142,13 +151,19 @@ static int ecdsa_sign_setup(EC_KEY *ecke
450916
         /*
450916
          * We do not want timing information to leak the length of k, so we
450916
          * compute G*k using an equivalent scalar of fixed bit-length.
450916
+         *
450916
+         * We unconditionally perform both of these additions to prevent a
450916
+         * small timing information leakage.  We then choose the sum that is
450916
+         * one bit longer than the order.  This guarantees the code
450916
+         * path used in the constant time implementations elsewhere.
450916
+         *
450916
+         * TODO: revisit the BN_copy aiming for a memory access agnostic
450916
+         * conditional copy.
450916
          */
450916
-
450916
-        if (!BN_add(k, k, order))
450916
+        if (!BN_add(r, k, order)
450916
+            || !BN_add(X, r, order)
450916
+            || !BN_copy(k, BN_num_bits(r) > order_bits ? r : X))
450916
             goto err;
450916
-        if (BN_num_bits(k) <= BN_num_bits(order))
450916
-            if (!BN_add(k, k, order))
450916
-                goto err;
450916
 
450916
         /* compute r the x-coordinate of generator * k */
450916
         if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx)) {
450916
@@ -240,13 +255,14 @@ static ECDSA_SIG *ecdsa_do_sign(const un
450916
                                 EC_KEY *eckey)
450916
 {
450916
     int ok = 0, i;
450916
-    BIGNUM *kinv = NULL, *s, *m = NULL, *tmp = NULL, *order = NULL;
450916
+    BIGNUM *kinv = NULL, *s, *m = NULL, *order = NULL;
450916
     const BIGNUM *ckinv;
450916
     BN_CTX *ctx = NULL;
450916
     const EC_GROUP *group;
450916
     ECDSA_SIG *ret;
450916
     ECDSA_DATA *ecdsa;
450916
     const BIGNUM *priv_key;
450916
+    BN_MONT_CTX *mont_data;
450916
 
450916
 #ifdef OPENSSL_FIPS
450916
     if (FIPS_selftest_failed()) {
450916
@@ -272,7 +288,7 @@ static ECDSA_SIG *ecdsa_do_sign(const un
450916
     s = ret->s;
450916
 
450916
     if ((ctx = BN_CTX_new()) == NULL || (order = BN_new()) == NULL ||
450916
-        (tmp = BN_new()) == NULL || (m = BN_new()) == NULL) {
450916
+        (m = BN_new()) == NULL) {
450916
         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_MALLOC_FAILURE);
450916
         goto err;
450916
     }
450916
@@ -281,6 +297,8 @@ static ECDSA_SIG *ecdsa_do_sign(const un
450916
         ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_EC_LIB);
450916
         goto err;
450916
     }
450916
+    mont_data = EC_GROUP_get_mont_data(group);
450916
+
450916
     i = BN_num_bits(order);
450916
     /*
450916
      * Need to truncate digest if it is too long: first truncate whole bytes.
450916
@@ -311,21 +329,33 @@ static ECDSA_SIG *ecdsa_do_sign(const un
450916
             }
450916
         }
450916
 
450916
-        if (!BN_mod_mul(tmp, priv_key, ret->r, order, ctx)) {
450916
-            ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
450916
+        /*
450916
+         * With only one multiplicant being in Montgomery domain
450916
+         * multiplication yields real result without post-conversion.
450916
+         * Also note that all operations but last are performed with
450916
+         * zero-padded vectors. Last operation, BN_mod_mul_montgomery
450916
+         * below, returns user-visible value with removed zero padding.
450916
+         */
450916
+        if (!bn_to_mont_fixed_top(s, ret->r, mont_data, ctx)
450916
+            || !bn_mul_mont_fixed_top(s, s, priv_key, mont_data, ctx)) {
450916
             goto err;
450916
         }
450916
-        if (!BN_mod_add_quick(s, tmp, m, order)) {
450916
+        if (!bn_mod_add_fixed_top(s, s, m, order)) {
450916
             ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
450916
             goto err;
450916
         }
450916
-        if (!BN_mod_mul(s, s, ckinv, order, ctx)) {
450916
+        /*
450916
+         * |s| can still be larger than modulus, because |m| can be. In
450916
+         * such case we count on Montgomery reduction to tie it up.
450916
+         */
450916
+        if (!bn_to_mont_fixed_top(s, s, mont_data, ctx)
450916
+            || !BN_mod_mul_montgomery(s, s, ckinv, mont_data, ctx)) {
450916
             ECDSAerr(ECDSA_F_ECDSA_DO_SIGN, ERR_R_BN_LIB);
450916
             goto err;
450916
         }
450916
         if (BN_is_zero(s)) {
450916
             /*
450916
-             * if kinv and r have been supplied by the caller don't to
450916
+             * if kinv and r have been supplied by the caller don't
450916
              * generate new kinv and r values
450916
              */
450916
             if (in_kinv != NULL && in_r != NULL) {
450916
@@ -349,8 +379,6 @@ static ECDSA_SIG *ecdsa_do_sign(const un
450916
         BN_CTX_free(ctx);
450916
     if (m)
450916
         BN_clear_free(m);
450916
-    if (tmp)
450916
-        BN_clear_free(tmp);
450916
     if (order)
450916
         BN_free(order);
450916
     if (kinv)
450916
diff -up openssl-1.0.2k/crypto/Makefile.rohnp-fix openssl-1.0.2k/crypto/Makefile
450916
--- openssl-1.0.2k/crypto/Makefile.rohnp-fix	2018-06-20 17:44:02.467404137 +0200
450916
+++ openssl-1.0.2k/crypto/Makefile	2018-08-14 10:57:21.595518774 +0200
450916
@@ -45,7 +45,7 @@ SRC= $(LIBSRC)
450916
 EXHEADER= crypto.h opensslv.h opensslconf.h ebcdic.h symhacks.h \
450916
 	ossl_typ.h
450916
 HEADER=	cryptlib.h buildinf.h md32_common.h o_time.h o_str.h o_dir.h \
450916
-	constant_time_locl.h $(EXHEADER)
450916
+	constant_time_locl.h bn_int.h $(EXHEADER)
450916
 
450916
 ALL=    $(GENERAL) $(SRC) $(HEADER)
450916