3eeb22
diff -up openssl-1.0.2k/crypto/bn/bn_blind.c.9-lives openssl-1.0.2k/crypto/bn/bn_blind.c
3eeb22
--- openssl-1.0.2k/crypto/bn/bn_blind.c.9-lives	2017-01-26 14:22:03.000000000 +0100
3eeb22
+++ openssl-1.0.2k/crypto/bn/bn_blind.c	2019-04-05 10:50:56.136104388 +0200
3eeb22
@@ -206,10 +206,15 @@ int BN_BLINDING_update(BN_BLINDING *b, B
3eeb22
         if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
3eeb22
             goto err;
3eeb22
     } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {
3eeb22
-        if (!BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))
3eeb22
-            goto err;
3eeb22
-        if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx))
3eeb22
-            goto err;
3eeb22
+        if (b->m_ctx != NULL) {
3eeb22
+            if (!bn_mul_mont_fixed_top(b->Ai, b->Ai, b->Ai, b->m_ctx, ctx)
3eeb22
+                || !bn_mul_mont_fixed_top(b->A, b->A, b->A, b->m_ctx, ctx))
3eeb22
+                goto err;
3eeb22
+        } else {
3eeb22
+            if (!BN_mod_mul(b->Ai, b->Ai, b->Ai, b->mod, ctx)
3eeb22
+                || !BN_mod_mul(b->A, b->A, b->A, b->mod, ctx))
3eeb22
+                goto err;
3eeb22
+        }
3eeb22
     }
3eeb22
 
3eeb22
     ret = 1;
3eeb22
@@ -241,13 +246,13 @@ int BN_BLINDING_convert_ex(BIGNUM *n, BI
3eeb22
     else if (!BN_BLINDING_update(b, ctx))
3eeb22
         return (0);
3eeb22
 
3eeb22
-    if (r != NULL) {
3eeb22
-        if (!BN_copy(r, b->Ai))
3eeb22
-            ret = 0;
3eeb22
-    }
3eeb22
+    if (r != NULL && (BN_copy(r, b->Ai) == NULL))
3eeb22
+        return 0;
3eeb22
 
3eeb22
-    if (!BN_mod_mul(n, n, b->A, b->mod, ctx))
3eeb22
-        ret = 0;
3eeb22
+    if (b->m_ctx != NULL)
3eeb22
+        ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);
3eeb22
+    else
3eeb22
+        ret = BN_mod_mul(n, n, b->A, b->mod, ctx);
3eeb22
 
3eeb22
     return ret;
3eeb22
 }
3eeb22
@@ -264,14 +269,29 @@ int BN_BLINDING_invert_ex(BIGNUM *n, con
3eeb22
 
3eeb22
     bn_check_top(n);
3eeb22
 
3eeb22
-    if (r != NULL)
3eeb22
-        ret = BN_mod_mul(n, n, r, b->mod, ctx);
3eeb22
-    else {
3eeb22
-        if (b->Ai == NULL) {
3eeb22
-            BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);
3eeb22
-            return (0);
3eeb22
+    if (r == NULL && (r = b->Ai) == NULL) {
3eeb22
+        BNerr(BN_F_BN_BLINDING_INVERT_EX, BN_R_NOT_INITIALIZED);
3eeb22
+        return 0;
3eeb22
+    }
3eeb22
+
3eeb22
+    if (b->m_ctx != NULL) {
3eeb22
+        /* ensure that BN_mod_mul_montgomery takes pre-defined path */
3eeb22
+        if (n->dmax >= r->top) {
3eeb22
+            size_t i, rtop = r->top, ntop = n->top;
3eeb22
+            BN_ULONG mask;
3eeb22
+
3eeb22
+            for (i = 0; i < rtop; i++) {
3eeb22
+                mask = (BN_ULONG)0 - ((i - ntop) >> (8 * sizeof(i) - 1));
3eeb22
+                n->d[i] &= mask;
3eeb22
+            }
3eeb22
+            mask = (BN_ULONG)0 - ((rtop - ntop) >> (8 * sizeof(ntop) - 1));
3eeb22
+            /* always true, if (rtop >= ntop) n->top = r->top; */
3eeb22
+            n->top = (int)(rtop & ~mask) | (ntop & mask);
3eeb22
+            n->flags |= (BN_FLG_FIXED_TOP & ~mask);
3eeb22
         }
3eeb22
-        ret = BN_mod_mul(n, n, b->Ai, b->mod, ctx);
3eeb22
+        ret = BN_mod_mul_montgomery(n, n, r, b->m_ctx, ctx);
3eeb22
+    } else {
3eeb22
+        ret = BN_mod_mul(n, n, r, b->mod, ctx);
3eeb22
     }
3eeb22
 
3eeb22
     bn_check_top(n);
3eeb22
@@ -366,14 +386,19 @@ BN_BLINDING *BN_BLINDING_create_param(BN
3eeb22
     } while (1);
3eeb22
 
3eeb22
     if (ret->bn_mod_exp != NULL && ret->m_ctx != NULL) {
3eeb22
-        if (!ret->bn_mod_exp
3eeb22
-            (ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))
3eeb22
+        if (!ret->bn_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx, ret->m_ctx))
3eeb22
             goto err;
3eeb22
     } else {
3eeb22
         if (!BN_mod_exp(ret->A, ret->A, ret->e, ret->mod, ctx))
3eeb22
             goto err;
3eeb22
     }
3eeb22
 
3eeb22
+    if (ret->m_ctx != NULL) {
3eeb22
+        if (!bn_to_mont_fixed_top(ret->Ai, ret->Ai, ret->m_ctx, ctx)
3eeb22
+            || !bn_to_mont_fixed_top(ret->A, ret->A, ret->m_ctx, ctx))
3eeb22
+            goto err;
3eeb22
+    }
3eeb22
+
3eeb22
     return ret;
3eeb22
  err:
3eeb22
     if (b == NULL && ret != NULL) {
3eeb22
diff -up openssl-1.0.2k/crypto/bn/bn_lib.c.9-lives openssl-1.0.2k/crypto/bn/bn_lib.c
3eeb22
--- openssl-1.0.2k/crypto/bn/bn_lib.c.9-lives	2019-04-05 10:50:56.128104529 +0200
3eeb22
+++ openssl-1.0.2k/crypto/bn/bn_lib.c	2019-04-05 10:50:56.136104388 +0200
3eeb22
@@ -144,74 +144,47 @@ const BIGNUM *BN_value_one(void)
3eeb22
 
3eeb22
 int BN_num_bits_word(BN_ULONG l)
3eeb22
 {
3eeb22
-    static const unsigned char bits[256] = {
3eeb22
-        0, 1, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 4, 4, 4, 4,
3eeb22
-        5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5,
3eeb22
-        6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,
3eeb22
-        6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6,
3eeb22
-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
3eeb22
-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
3eeb22
-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
3eeb22
-        7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-        8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8,
3eeb22
-    };
3eeb22
-
3eeb22
-#if defined(SIXTY_FOUR_BIT_LONG)
3eeb22
-    if (l & 0xffffffff00000000L) {
3eeb22
-        if (l & 0xffff000000000000L) {
3eeb22
-            if (l & 0xff00000000000000L) {
3eeb22
-                return (bits[(int)(l >> 56)] + 56);
3eeb22
-            } else
3eeb22
-                return (bits[(int)(l >> 48)] + 48);
3eeb22
-        } else {
3eeb22
-            if (l & 0x0000ff0000000000L) {
3eeb22
-                return (bits[(int)(l >> 40)] + 40);
3eeb22
-            } else
3eeb22
-                return (bits[(int)(l >> 32)] + 32);
3eeb22
-        }
3eeb22
-    } else
3eeb22
-#else
3eeb22
-# ifdef SIXTY_FOUR_BIT
3eeb22
-    if (l & 0xffffffff00000000LL) {
3eeb22
-        if (l & 0xffff000000000000LL) {
3eeb22
-            if (l & 0xff00000000000000LL) {
3eeb22
-                return (bits[(int)(l >> 56)] + 56);
3eeb22
-            } else
3eeb22
-                return (bits[(int)(l >> 48)] + 48);
3eeb22
-        } else {
3eeb22
-            if (l & 0x0000ff0000000000LL) {
3eeb22
-                return (bits[(int)(l >> 40)] + 40);
3eeb22
-            } else
3eeb22
-                return (bits[(int)(l >> 32)] + 32);
3eeb22
-        }
3eeb22
-    } else
3eeb22
-# endif
3eeb22
-#endif
3eeb22
-    {
3eeb22
-#if defined(THIRTY_TWO_BIT) || defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)
3eeb22
-        if (l & 0xffff0000L) {
3eeb22
-            if (l & 0xff000000L)
3eeb22
-                return (bits[(int)(l >> 24L)] + 24);
3eeb22
-            else
3eeb22
-                return (bits[(int)(l >> 16L)] + 16);
3eeb22
-        } else
3eeb22
-#endif
3eeb22
-        {
3eeb22
-#if defined(THIRTY_TWO_BIT) || defined(SIXTY_FOUR_BIT) || defined(SIXTY_FOUR_BIT_LONG)
3eeb22
-            if (l & 0xff00L)
3eeb22
-                return (bits[(int)(l >> 8)] + 8);
3eeb22
-            else
3eeb22
+    BN_ULONG x, mask;
3eeb22
+    int bits = (l != 0);
3eeb22
+
3eeb22
+#if BN_BITS2 > 32
3eeb22
+    x = l >> 32;
3eeb22
+    mask = (0 - x) & BN_MASK2;
3eeb22
+    mask = (0 - (mask >> (BN_BITS2 - 1)));
3eeb22
+    bits += 32 & mask;
3eeb22
+    l ^= (x ^ l) & mask;
3eeb22
 #endif
3eeb22
-                return (bits[(int)(l)]);
3eeb22
-        }
3eeb22
-    }
3eeb22
+
3eeb22
+    x = l >> 16;
3eeb22
+    mask = (0 - x) & BN_MASK2;
3eeb22
+    mask = (0 - (mask >> (BN_BITS2 - 1)));
3eeb22
+    bits += 16 & mask;
3eeb22
+    l ^= (x ^ l) & mask;
3eeb22
+
3eeb22
+    x = l >> 8;
3eeb22
+    mask = (0 - x) & BN_MASK2;
3eeb22
+    mask = (0 - (mask >> (BN_BITS2 - 1)));
3eeb22
+    bits += 8 & mask;
3eeb22
+    l ^= (x ^ l) & mask;
3eeb22
+
3eeb22
+    x = l >> 4;
3eeb22
+    mask = (0 - x) & BN_MASK2;
3eeb22
+    mask = (0 - (mask >> (BN_BITS2 - 1)));
3eeb22
+    bits += 4 & mask;
3eeb22
+    l ^= (x ^ l) & mask;
3eeb22
+
3eeb22
+    x = l >> 2;
3eeb22
+    mask = (0 - x) & BN_MASK2;
3eeb22
+    mask = (0 - (mask >> (BN_BITS2 - 1)));
3eeb22
+    bits += 2 & mask;
3eeb22
+    l ^= (x ^ l) & mask;
3eeb22
+
3eeb22
+    x = l >> 1;
3eeb22
+    mask = (0 - x) & BN_MASK2;
3eeb22
+    mask = (0 - (mask >> (BN_BITS2 - 1)));
3eeb22
+    bits += 1 & mask;
3eeb22
+
3eeb22
+    return bits;
3eeb22
 }
3eeb22
 
3eeb22
 int BN_num_bits(const BIGNUM *a)
3eeb22
@@ -519,12 +492,18 @@ BIGNUM *BN_copy(BIGNUM *a, const BIGNUM
3eeb22
     memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
3eeb22
 #endif
3eeb22
 
3eeb22
-    a->top = b->top;
3eeb22
     a->neg = b->neg;
3eeb22
+    a->top = b->top;
3eeb22
+    a->flags |= b->flags & BN_FLG_FIXED_TOP;
3eeb22
     bn_check_top(a);
3eeb22
     return (a);
3eeb22
 }
3eeb22
 
3eeb22
+#define FLAGS_DATA(flags) ((flags) & (BN_FLG_STATIC_DATA \
3eeb22
+                                    | BN_FLG_CONSTTIME   \
3eeb22
+                                    | BN_FLG_FIXED_TOP))
3eeb22
+#define FLAGS_STRUCT(flags) ((flags) & (BN_FLG_MALLOCED))
3eeb22
+
3eeb22
 void BN_swap(BIGNUM *a, BIGNUM *b)
3eeb22
 {
3eeb22
     int flags_old_a, flags_old_b;
3eeb22
@@ -552,10 +531,8 @@ void BN_swap(BIGNUM *a, BIGNUM *b)
3eeb22
     b->dmax = tmp_dmax;
3eeb22
     b->neg = tmp_neg;
3eeb22
 
3eeb22
-    a->flags =
3eeb22
-        (flags_old_a & BN_FLG_MALLOCED) | (flags_old_b & BN_FLG_STATIC_DATA);
3eeb22
-    b->flags =
3eeb22
-        (flags_old_b & BN_FLG_MALLOCED) | (flags_old_a & BN_FLG_STATIC_DATA);
3eeb22
+    a->flags = FLAGS_STRUCT(flags_old_a) | FLAGS_DATA(flags_old_b);
3eeb22
+    b->flags = FLAGS_STRUCT(flags_old_b) | FLAGS_DATA(flags_old_a);
3eeb22
     bn_check_top(a);
3eeb22
     bn_check_top(b);
3eeb22
 }
3eeb22
@@ -637,6 +614,55 @@ BIGNUM *BN_bin2bn(const unsigned char *s
3eeb22
 }
3eeb22
 
3eeb22
 /* ignore negative */
3eeb22
+static int bn2binpad(const BIGNUM *a, unsigned char *to, int tolen)
3eeb22
+{
3eeb22
+    int n;
3eeb22
+    size_t i, lasti, j, atop, mask;
3eeb22
+    BN_ULONG l;
3eeb22
+
3eeb22
+    /*
3eeb22
+     * In case |a| is fixed-top, BN_num_bytes can return bogus length,
3eeb22
+     * but it's assumed that fixed-top inputs ought to be "nominated"
3eeb22
+     * even for padded output, so it works out...
3eeb22
+     */
3eeb22
+    n = BN_num_bytes(a);
3eeb22
+    if (tolen == -1) {
3eeb22
+        tolen = n;
3eeb22
+    } else if (tolen < n) {     /* uncommon/unlike case */
3eeb22
+        BIGNUM temp = *a;
3eeb22
+
3eeb22
+        bn_correct_top(&temp);
3eeb22
+        n = BN_num_bytes(&temp);
3eeb22
+        if (tolen < n)
3eeb22
+            return -1;
3eeb22
+    }
3eeb22
+
3eeb22
+    /* Swipe through whole available data and don't give away padded zero. */
3eeb22
+    atop = a->dmax * BN_BYTES;
3eeb22
+    if (atop == 0) {
3eeb22
+        OPENSSL_cleanse(to, tolen);
3eeb22
+        return tolen;
3eeb22
+    }
3eeb22
+
3eeb22
+    lasti = atop - 1;
3eeb22
+    atop = a->top * BN_BYTES;
3eeb22
+    for (i = 0, j = 0, to += tolen; j < (size_t)tolen; j++) {
3eeb22
+        l = a->d[i / BN_BYTES];
3eeb22
+        mask = 0 - ((j - atop) >> (8 * sizeof(i) - 1));
3eeb22
+        *--to = (unsigned char)(l >> (8 * (i % BN_BYTES)) & mask);
3eeb22
+        i += (i - lasti) >> (8 * sizeof(i) - 1); /* stay on last limb */
3eeb22
+    }
3eeb22
+
3eeb22
+    return tolen;
3eeb22
+}
3eeb22
+
3eeb22
+int bn_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen)
3eeb22
+{
3eeb22
+    if (tolen < 0)
3eeb22
+        return -1;
3eeb22
+    return bn2binpad(a, to, tolen);
3eeb22
+}
3eeb22
+
3eeb22
 int BN_bn2bin(const BIGNUM *a, unsigned char *to)
3eeb22
 {
3eeb22
     int n, i;
3eeb22
@@ -810,6 +836,9 @@ int bn_cmp_words(const BN_ULONG *a, cons
3eeb22
     int i;
3eeb22
     BN_ULONG aa, bb;
3eeb22
 
3eeb22
+    if (n == 0)
3eeb22
+        return 0;
3eeb22
+
3eeb22
     aa = a[n - 1];
3eeb22
     bb = b[n - 1];
3eeb22
     if (aa != bb)
3eeb22
diff -up openssl-1.0.2k/crypto/bn/bn_mod.c.9-lives openssl-1.0.2k/crypto/bn/bn_mod.c
3eeb22
--- openssl-1.0.2k/crypto/bn/bn_mod.c.9-lives	2019-04-05 10:50:56.125104581 +0200
3eeb22
+++ openssl-1.0.2k/crypto/bn/bn_mod.c	2019-04-05 10:50:56.136104388 +0200
3eeb22
@@ -197,6 +197,7 @@ int bn_mod_add_fixed_top(BIGNUM *r, cons
3eeb22
         ((volatile BN_ULONG *)tp)[i] = 0;
3eeb22
     }
3eeb22
     r->top = mtop;
3eeb22
+    r->flags |= BN_FLG_FIXED_TOP;
3eeb22
     r->neg = 0;
3eeb22
 
3eeb22
     if (tp != storage)
3eeb22
@@ -225,6 +226,70 @@ int BN_mod_sub(BIGNUM *r, const BIGNUM *
3eeb22
 }
3eeb22
 
3eeb22
 /*
3eeb22
+ * BN_mod_sub variant that may be used if both a and b are non-negative,
3eeb22
+ * a is less than m, while b is of same bit width as m. It's implemented
3eeb22
+ * as subtraction followed by two conditional additions.
3eeb22
+ *
3eeb22
+ * 0 <= a < m
3eeb22
+ * 0 <= b < 2^w < 2*m
3eeb22
+ *
3eeb22
+ * after subtraction
3eeb22
+ *
3eeb22
+ * -2*m < r = a - b < m
3eeb22
+ *
3eeb22
+ * Thus it takes up to two conditional additions to make |r| positive.
3eeb22
+ */
3eeb22
+int bn_mod_sub_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
3eeb22
+                         const BIGNUM *m)
3eeb22
+{
3eeb22
+    size_t i, ai, bi, mtop = m->top;
3eeb22
+    BN_ULONG borrow, carry, ta, tb, mask, *rp;
3eeb22
+    const BN_ULONG *ap, *bp;
3eeb22
+
3eeb22
+    if (bn_wexpand(r, m->top) == NULL)
3eeb22
+        return 0;
3eeb22
+
3eeb22
+    rp = r->d;
3eeb22
+    ap = a->d != NULL ? a->d : rp;
3eeb22
+    bp = b->d != NULL ? b->d : rp;
3eeb22
+
3eeb22
+    for (i = 0, ai = 0, bi = 0, borrow = 0; i < mtop;) {
3eeb22
+        mask = (BN_ULONG)0 - ((i - a->top) >> (8 * sizeof(i) - 1));
3eeb22
+        ta = ap[ai] & mask;
3eeb22
+
3eeb22
+        mask = (BN_ULONG)0 - ((i - b->top) >> (8 * sizeof(i) - 1));
3eeb22
+        tb = bp[bi] & mask;
3eeb22
+        rp[i] = ta - tb - borrow;
3eeb22
+        if (ta != tb)
3eeb22
+            borrow = (ta < tb);
3eeb22
+
3eeb22
+        i++;
3eeb22
+        ai += (i - a->dmax) >> (8 * sizeof(i) - 1);
3eeb22
+        bi += (i - b->dmax) >> (8 * sizeof(i) - 1);
3eeb22
+    }
3eeb22
+    ap = m->d;
3eeb22
+    for (i = 0, mask = 0 - borrow, carry = 0; i < mtop; i++) {
3eeb22
+        ta = ((ap[i] & mask) + carry) & BN_MASK2;
3eeb22
+        carry = (ta < carry);
3eeb22
+        rp[i] = (rp[i] + ta) & BN_MASK2;
3eeb22
+        carry += (rp[i] < ta);
3eeb22
+    }
3eeb22
+    borrow -= carry;
3eeb22
+    for (i = 0, mask = 0 - borrow, carry = 0; i < mtop; i++) {
3eeb22
+        ta = ((ap[i] & mask) + carry) & BN_MASK2;
3eeb22
+        carry = (ta < carry);
3eeb22
+        rp[i] = (rp[i] + ta) & BN_MASK2;
3eeb22
+        carry += (rp[i] < ta);
3eeb22
+    }
3eeb22
+
3eeb22
+    r->top = mtop;
3eeb22
+    r->flags |= BN_FLG_FIXED_TOP;
3eeb22
+    r->neg = 0;
3eeb22
+
3eeb22
+    return 1;
3eeb22
+}
3eeb22
+
3eeb22
+/*
3eeb22
  * BN_mod_sub variant that may be used if both a and b are non-negative and
3eeb22
  * less than m
3eeb22
  */
3eeb22
diff -up openssl-1.0.2k/crypto/bn/bn_mont.c.9-lives openssl-1.0.2k/crypto/bn/bn_mont.c
3eeb22
--- openssl-1.0.2k/crypto/bn/bn_mont.c.9-lives	2019-04-05 10:50:56.125104581 +0200
3eeb22
+++ openssl-1.0.2k/crypto/bn/bn_mont.c	2019-04-05 10:50:56.137104370 +0200
3eeb22
@@ -164,10 +164,10 @@ int bn_mul_mont_fixed_top(BIGNUM *r, con
3eeb22
 
3eeb22
     bn_check_top(tmp);
3eeb22
     if (a == b) {
3eeb22
-        if (!BN_sqr(tmp, a, ctx))
3eeb22
+        if (!bn_sqr_fixed_top(tmp, a, ctx))
3eeb22
             goto err;
3eeb22
     } else {
3eeb22
-        if (!BN_mul(tmp, a, b, ctx))
3eeb22
+        if (!bn_mul_fixed_top(tmp, a, b, ctx))
3eeb22
             goto err;
3eeb22
     }
3eeb22
     /* reduce from aRR to aR */
3eeb22
@@ -190,6 +190,7 @@ static int bn_from_montgomery_word(BIGNU
3eeb22
     BIGNUM *n;
3eeb22
     BN_ULONG *ap, *np, *rp, n0, v, carry;
3eeb22
     int nl, max, i;
3eeb22
+    unsigned int rtop;
3eeb22
 
3eeb22
     n = &(mont->N);
3eeb22
     nl = n->top;
3eeb22
@@ -207,12 +208,10 @@ static int bn_from_montgomery_word(BIGNU
3eeb22
     rp = r->d;
3eeb22
 
3eeb22
     /* clear the top words of T */
3eeb22
-# if 1
3eeb22
-    for (i = r->top; i < max; i++) /* memset? XXX */
3eeb22
-        rp[i] = 0;
3eeb22
-# else
3eeb22
-    memset(&(rp[r->top]), 0, (max - r->top) * sizeof(BN_ULONG));
3eeb22
-# endif
3eeb22
+    for (rtop = r->top, i = 0; i < max; i++) {
3eeb22
+        v = (BN_ULONG)0 - ((i - rtop) >> (8 * sizeof(rtop) - 1));
3eeb22
+        rp[i] &= v;
3eeb22
+    }
3eeb22
 
3eeb22
     r->top = max;
3eeb22
     r->flags |= BN_FLG_FIXED_TOP;
3eeb22
@@ -263,6 +262,18 @@ static int bn_from_montgomery_word(BIGNU
3eeb22
 int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
3eeb22
                        BN_CTX *ctx)
3eeb22
 {
3eeb22
+    int retn;
3eeb22
+
3eeb22
+    retn = bn_from_mont_fixed_top(ret, a, mont, ctx);
3eeb22
+    bn_correct_top(ret);
3eeb22
+    bn_check_top(ret);
3eeb22
+
3eeb22
+    return retn;
3eeb22
+}
3eeb22
+
3eeb22
+int bn_from_mont_fixed_top(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
3eeb22
+                           BN_CTX *ctx)
3eeb22
+{
3eeb22
     int retn = 0;
3eeb22
 #ifdef MONT_WORD
3eeb22
     BIGNUM *t;
3eeb22
@@ -270,8 +281,6 @@ int BN_from_montgomery(BIGNUM *ret, cons
3eeb22
     BN_CTX_start(ctx);
3eeb22
     if ((t = BN_CTX_get(ctx)) && BN_copy(t, a)) {
3eeb22
         retn = bn_from_montgomery_word(ret, t, mont);
3eeb22
-        bn_correct_top(ret);
3eeb22
-        bn_check_top(ret);
3eeb22
     }
3eeb22
     BN_CTX_end(ctx);
3eeb22
 #else                           /* !MONT_WORD */
3eeb22
diff -up openssl-1.0.2k/crypto/bn/bn_mul.c.9-lives openssl-1.0.2k/crypto/bn/bn_mul.c
3eeb22
--- openssl-1.0.2k/crypto/bn/bn_mul.c.9-lives	2017-01-26 14:22:03.000000000 +0100
3eeb22
+++ openssl-1.0.2k/crypto/bn/bn_mul.c	2019-04-05 10:50:56.137104370 +0200
3eeb22
@@ -936,6 +936,16 @@ void bn_mul_high(BN_ULONG *r, BN_ULONG *
3eeb22
 
3eeb22
 int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
3eeb22
 {
3eeb22
+    int ret = bn_mul_fixed_top(r, a, b, ctx);
3eeb22
+
3eeb22
+    bn_correct_top(r);
3eeb22
+    bn_check_top(r);
3eeb22
+
3eeb22
+    return ret;
3eeb22
+}
3eeb22
+
3eeb22
+int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
3eeb22
+{
3eeb22
     int ret = 0;
3eeb22
     int top, al, bl;
3eeb22
     BIGNUM *rr;
3eeb22
@@ -1032,46 +1042,6 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, c
3eeb22
             rr->top = top;
3eeb22
             goto end;
3eeb22
         }
3eeb22
-# if 0
3eeb22
-        if (i == 1 && !BN_get_flags(b, BN_FLG_STATIC_DATA)) {
3eeb22
-            BIGNUM *tmp_bn = (BIGNUM *)b;
3eeb22
-            if (bn_wexpand(tmp_bn, al) == NULL)
3eeb22
-                goto err;
3eeb22
-            tmp_bn->d[bl] = 0;
3eeb22
-            bl++;
3eeb22
-            i--;
3eeb22
-        } else if (i == -1 && !BN_get_flags(a, BN_FLG_STATIC_DATA)) {
3eeb22
-            BIGNUM *tmp_bn = (BIGNUM *)a;
3eeb22
-            if (bn_wexpand(tmp_bn, bl) == NULL)
3eeb22
-                goto err;
3eeb22
-            tmp_bn->d[al] = 0;
3eeb22
-            al++;
3eeb22
-            i++;
3eeb22
-        }
3eeb22
-        if (i == 0) {
3eeb22
-            /* symmetric and > 4 */
3eeb22
-            /* 16 or larger */
3eeb22
-            j = BN_num_bits_word((BN_ULONG)al);
3eeb22
-            j = 1 << (j - 1);
3eeb22
-            k = j + j;
3eeb22
-            t = BN_CTX_get(ctx);
3eeb22
-            if (al == j) {      /* exact multiple */
3eeb22
-                if (bn_wexpand(t, k * 2) == NULL)
3eeb22
-                    goto err;
3eeb22
-                if (bn_wexpand(rr, k * 2) == NULL)
3eeb22
-                    goto err;
3eeb22
-                bn_mul_recursive(rr->d, a->d, b->d, al, t->d);
3eeb22
-            } else {
3eeb22
-                if (bn_wexpand(t, k * 4) == NULL)
3eeb22
-                    goto err;
3eeb22
-                if (bn_wexpand(rr, k * 4) == NULL)
3eeb22
-                    goto err;
3eeb22
-                bn_mul_part_recursive(rr->d, a->d, b->d, al - j, j, t->d);
3eeb22
-            }
3eeb22
-            rr->top = top;
3eeb22
-            goto end;
3eeb22
-        }
3eeb22
-# endif
3eeb22
     }
3eeb22
 #endif                          /* BN_RECURSION */
3eeb22
     if (bn_wexpand(rr, top) == NULL)
3eeb22
@@ -1082,7 +1052,7 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, c
3eeb22
 #if defined(BN_MUL_COMBA) || defined(BN_RECURSION)
3eeb22
  end:
3eeb22
 #endif
3eeb22
-    bn_correct_top(rr);
3eeb22
+    rr->flags |= BN_FLG_FIXED_TOP;
3eeb22
     if (r != rr && BN_copy(r, rr) == NULL)
3eeb22
         goto err;
3eeb22
 
3eeb22
diff -up openssl-1.0.2k/crypto/bn/bn_sqr.c.9-lives openssl-1.0.2k/crypto/bn/bn_sqr.c
3eeb22
--- openssl-1.0.2k/crypto/bn/bn_sqr.c.9-lives	2019-04-05 10:50:56.125104581 +0200
3eeb22
+++ openssl-1.0.2k/crypto/bn/bn_sqr.c	2019-04-05 10:50:56.137104370 +0200
3eeb22
@@ -66,6 +66,16 @@
3eeb22
  */
3eeb22
 int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
3eeb22
 {
3eeb22
+    int ret = bn_sqr_fixed_top(r, a, ctx);
3eeb22
+
3eeb22
+    bn_correct_top(r);
3eeb22
+    bn_check_top(r);
3eeb22
+
3eeb22
+    return ret;
3eeb22
+}
3eeb22
+
3eeb22
+int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
3eeb22
+{
3eeb22
     int max, al;
3eeb22
     int ret = 0;
3eeb22
     BIGNUM *tmp, *rr;
3eeb22
@@ -136,7 +146,7 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, B
3eeb22
 
3eeb22
     rr->neg = 0;
3eeb22
     rr->top = max;
3eeb22
-    bn_correct_top(rr);
3eeb22
+    rr->flags |= BN_FLG_FIXED_TOP;
3eeb22
     if (r != rr && BN_copy(r, rr) == NULL)
3eeb22
         goto err;
3eeb22
 
3eeb22
diff -up openssl-1.0.2k/crypto/bn_int.h.9-lives openssl-1.0.2k/crypto/bn_int.h
3eeb22
--- openssl-1.0.2k/crypto/bn_int.h.9-lives	2019-04-05 10:50:56.125104581 +0200
3eeb22
+++ openssl-1.0.2k/crypto/bn_int.h	2019-04-05 10:50:56.137104370 +0200
3eeb22
@@ -7,7 +7,15 @@
3eeb22
  */
3eeb22
 int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
3eeb22
                           BN_MONT_CTX *mont, BN_CTX *ctx);
3eeb22
+int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
3eeb22
+                           BN_CTX *ctx);
3eeb22
 int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
3eeb22
                          BN_CTX *ctx);
3eeb22
 int bn_mod_add_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
3eeb22
                          const BIGNUM *m);
3eeb22
+int bn_mod_sub_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
3eeb22
+                         const BIGNUM *m);
3eeb22
+int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx);
3eeb22
+int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx);
3eeb22
+
3eeb22
+int bn_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen);
3eeb22
diff -up openssl-1.0.2k/crypto/constant_time_locl.h.9-lives openssl-1.0.2k/crypto/constant_time_locl.h
3eeb22
--- openssl-1.0.2k/crypto/constant_time_locl.h.9-lives	2019-04-05 10:50:55.545114779 +0200
3eeb22
+++ openssl-1.0.2k/crypto/constant_time_locl.h	2019-04-05 10:50:56.137104370 +0200
3eeb22
@@ -204,6 +204,12 @@ static inline int constant_time_select_i
3eeb22
     return (int)(constant_time_select(mask, (unsigned)(a), (unsigned)(b)));
3eeb22
 }
3eeb22
 
3eeb22
+/*
3eeb22
+ * Expected usage pattern is to unconditionally set error and then
3eeb22
+ * wipe it if there was no actual error. |clear| is 1 or 0.
3eeb22
+ */
3eeb22
+void err_clear_last_constant_time(int clear);
3eeb22
+
3eeb22
 #ifdef __cplusplus
3eeb22
 }
3eeb22
 #endif
3eeb22
diff -up openssl-1.0.2k/crypto/err/err.c.9-lives openssl-1.0.2k/crypto/err/err.c
3eeb22
--- openssl-1.0.2k/crypto/err/err.c.9-lives	2017-01-26 14:22:03.000000000 +0100
3eeb22
+++ openssl-1.0.2k/crypto/err/err.c	2019-04-05 10:50:56.138104353 +0200
3eeb22
@@ -118,6 +118,7 @@
3eeb22
 #include <openssl buffer.h="">
3eeb22
 #include <openssl bio.h="">
3eeb22
 #include <openssl err.h="">
3eeb22
+#include "constant_time_locl.h"
3eeb22
 
3eeb22
 DECLARE_LHASH_OF(ERR_STRING_DATA);
3eeb22
 DECLARE_LHASH_OF(ERR_STATE);
3eeb22
@@ -819,8 +820,24 @@ static unsigned long get_error_values(in
3eeb22
         return ERR_R_INTERNAL_ERROR;
3eeb22
     }
3eeb22
 
3eeb22
+    while (es->bottom != es->top) {
3eeb22
+        if (es->err_flags[es->top] & ERR_FLAG_CLEAR) {
3eeb22
+            err_clear(es, es->top);
3eeb22
+            es->top = es->top > 0 ? es->top - 1 : ERR_NUM_ERRORS - 1;
3eeb22
+            continue;
3eeb22
+        }
3eeb22
+        i = (es->bottom + 1) % ERR_NUM_ERRORS;
3eeb22
+        if (es->err_flags[i] & ERR_FLAG_CLEAR) {
3eeb22
+            es->bottom = i;
3eeb22
+            err_clear(es, es->bottom);
3eeb22
+            continue;
3eeb22
+        }
3eeb22
+        break;
3eeb22
+    }
3eeb22
+
3eeb22
     if (es->bottom == es->top)
3eeb22
         return 0;
3eeb22
+
3eeb22
     if (top)
3eeb22
         i = es->top;            /* last error */
3eeb22
     else
3eeb22
@@ -1146,3 +1163,23 @@ int ERR_pop_to_mark(void)
3eeb22
     es->err_flags[es->top] &= ~ERR_FLAG_MARK;
3eeb22
     return 1;
3eeb22
 }
3eeb22
+
3eeb22
+void err_clear_last_constant_time(int clear)
3eeb22
+{
3eeb22
+    ERR_STATE *es;
3eeb22
+    int top;
3eeb22
+
3eeb22
+    es = ERR_get_state();
3eeb22
+    if (es == NULL)
3eeb22
+        return;
3eeb22
+
3eeb22
+    top = es->top;
3eeb22
+
3eeb22
+    /*
3eeb22
+     * Flag error as cleared but remove it elsewhere to avoid two errors
3eeb22
+     * accessing the same error stack location, revealing timing information.
3eeb22
+     */
3eeb22
+    clear = constant_time_select_int(constant_time_eq_int(clear, 0),
3eeb22
+                                     0, ERR_FLAG_CLEAR);
3eeb22
+    es->err_flags[top] |= clear;
3eeb22
+}
3eeb22
diff -up openssl-1.0.2k/crypto/err/err.h.9-lives openssl-1.0.2k/crypto/err/err.h
3eeb22
--- openssl-1.0.2k/crypto/err/err.h.9-lives	2019-04-05 10:50:55.450116449 +0200
3eeb22
+++ openssl-1.0.2k/crypto/err/err.h	2019-04-05 11:14:57.689757981 +0200
3eeb22
@@ -143,6 +143,7 @@ extern "C" {
3eeb22
 # define ERR_TXT_STRING          0x02
3eeb22
 
3eeb22
 # define ERR_FLAG_MARK           0x01
3eeb22
+# define ERR_FLAG_CLEAR          0x02
3eeb22
 
3eeb22
 # define ERR_NUM_ERRORS  16
3eeb22
 typedef struct err_state_st {
3eeb22
diff -up openssl-1.0.2k/crypto/rsa/rsa_eay.c.9-lives openssl-1.0.2k/crypto/rsa/rsa_eay.c
3eeb22
--- openssl-1.0.2k/crypto/rsa/rsa_eay.c.9-lives	2019-04-05 10:50:55.998106814 +0200
3eeb22
+++ openssl-1.0.2k/crypto/rsa/rsa_eay.c	2019-04-05 10:50:56.138104353 +0200
3eeb22
@@ -118,6 +118,8 @@
3eeb22
 #ifdef OPENSSL_FIPS
3eeb22
 # include <openssl fips.h="">
3eeb22
 #endif
3eeb22
+#include "bn_int.h"
3eeb22
+#include "constant_time_locl.h"
3eeb22
 
3eeb22
 #ifndef RSA_NULL
3eeb22
 
3eeb22
@@ -160,7 +162,7 @@ static int RSA_eay_public_encrypt(int fl
3eeb22
                                   unsigned char *to, RSA *rsa, int padding)
3eeb22
 {
3eeb22
     BIGNUM *f, *ret;
3eeb22
-    int i, j, k, num = 0, r = -1;
3eeb22
+    int i, num = 0, r = -1;
3eeb22
     unsigned char *buf = NULL;
3eeb22
     BN_CTX *ctx = NULL;
3eeb22
 
3eeb22
@@ -252,15 +254,10 @@ static int RSA_eay_public_encrypt(int fl
3eeb22
         goto err;
3eeb22
 
3eeb22
     /*
3eeb22
-     * put in leading 0 bytes if the number is less than the length of the
3eeb22
-     * modulus
3eeb22
+     * BN_bn2binpad puts in leading 0 bytes if the number is less than
3eeb22
+     * the length of the modulus.
3eeb22
      */
3eeb22
-    j = BN_num_bytes(ret);
3eeb22
-    i = BN_bn2bin(ret, &(to[num - j]));
3eeb22
-    for (k = 0; k < (num - i); k++)
3eeb22
-        to[k] = 0;
3eeb22
-
3eeb22
-    r = num;
3eeb22
+    r = bn_bn2binpad(ret, to, num);
3eeb22
  err:
3eeb22
     if (ctx != NULL) {
3eeb22
         BN_CTX_end(ctx);
3eeb22
@@ -369,7 +366,7 @@ static int RSA_eay_private_encrypt(int f
3eeb22
                                    unsigned char *to, RSA *rsa, int padding)
3eeb22
 {
3eeb22
     BIGNUM *f, *ret, *res;
3eeb22
-    int i, j, k, num = 0, r = -1;
3eeb22
+    int i, num = 0, r = -1;
3eeb22
     unsigned char *buf = NULL;
3eeb22
     BN_CTX *ctx = NULL;
3eeb22
     int local_blinding = 0;
3eeb22
@@ -437,6 +434,11 @@ static int RSA_eay_private_encrypt(int f
3eeb22
         goto err;
3eeb22
     }
3eeb22
 
3eeb22
+    if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
3eeb22
+        if (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA,
3eeb22
+                                    rsa->n, ctx))
3eeb22
+            goto err;
3eeb22
+
3eeb22
     if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {
3eeb22
         blinding = rsa_get_blinding(rsa, &local_blinding, ctx);
3eeb22
         if (blinding == NULL) {
3eeb22
@@ -471,11 +473,6 @@ static int RSA_eay_private_encrypt(int f
3eeb22
         } else
3eeb22
             d = rsa->d;
3eeb22
 
3eeb22
-        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)
3eeb22
-            if (!BN_MONT_CTX_set_locked
3eeb22
-                (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
3eeb22
-                goto err;
3eeb22
-
3eeb22
         if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,
3eeb22
                                    rsa->_method_mod_n))
3eeb22
             goto err;
3eeb22
@@ -495,15 +492,10 @@ static int RSA_eay_private_encrypt(int f
3eeb22
         res = ret;
3eeb22
 
3eeb22
     /*
3eeb22
-     * put in leading 0 bytes if the number is less than the length of the
3eeb22
-     * modulus
3eeb22
+     * BN_bn2binpad puts in leading 0 bytes if the number is less than
3eeb22
+     * the length of the modulus.
3eeb22
      */
3eeb22
-    j = BN_num_bytes(res);
3eeb22
-    i = BN_bn2bin(res, &(to[num - j]));
3eeb22
-    for (k = 0; k < (num - i); k++)
3eeb22
-        to[k] = 0;
3eeb22
-
3eeb22
-    r = num;
3eeb22
+    r = bn_bn2binpad(res, to, num);
3eeb22
  err:
3eeb22
     if (ctx != NULL) {
3eeb22
         BN_CTX_end(ctx);
3eeb22
@@ -521,7 +513,6 @@ static int RSA_eay_private_decrypt(int f
3eeb22
 {
3eeb22
     BIGNUM *f, *ret;
3eeb22
     int j, num = 0, r = -1;
3eeb22
-    unsigned char *p;
3eeb22
     unsigned char *buf = NULL;
3eeb22
     BN_CTX *ctx = NULL;
3eeb22
     int local_blinding = 0;
3eeb22
@@ -628,8 +619,7 @@ static int RSA_eay_private_decrypt(int f
3eeb22
         if (!rsa_blinding_invert(blinding, ret, unblind, ctx))
3eeb22
             goto err;
3eeb22
 
3eeb22
-    p = buf;
3eeb22
-    j = BN_bn2bin(ret, p);      /* j is only used with no-padding mode */
3eeb22
+    j = bn_bn2binpad(ret, buf, num);
3eeb22
 
3eeb22
     switch (padding) {
3eeb22
     case RSA_PKCS1_PADDING:
3eeb22
@@ -644,14 +634,14 @@ static int RSA_eay_private_decrypt(int f
3eeb22
         r = RSA_padding_check_SSLv23(to, num, buf, j, num);
3eeb22
         break;
3eeb22
     case RSA_NO_PADDING:
3eeb22
-        r = RSA_padding_check_none(to, num, buf, j, num);
3eeb22
+        memcpy(to, buf, (r = j));
3eeb22
         break;
3eeb22
     default:
3eeb22
         RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
3eeb22
         goto err;
3eeb22
     }
3eeb22
-    if (r < 0)
3eeb22
-        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);
3eeb22
+    RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);
3eeb22
+    err_clear_last_constant_time(1 & ~constant_time_msb(r));
3eeb22
 
3eeb22
  err:
3eeb22
     if (ctx != NULL) {
3eeb22
@@ -671,7 +661,6 @@ static int RSA_eay_public_decrypt(int fl
3eeb22
 {
3eeb22
     BIGNUM *f, *ret;
3eeb22
     int i, num = 0, r = -1;
3eeb22
-    unsigned char *p;
3eeb22
     unsigned char *buf = NULL;
3eeb22
     BN_CTX *ctx = NULL;
3eeb22
 
3eeb22
@@ -752,8 +741,7 @@ static int RSA_eay_public_decrypt(int fl
3eeb22
         if (!BN_sub(ret, rsa->n, ret))
3eeb22
             goto err;
3eeb22
 
3eeb22
-    p = buf;
3eeb22
-    i = BN_bn2bin(ret, p);
3eeb22
+    i = bn_bn2binpad(ret, buf, num);
3eeb22
 
3eeb22
     switch (padding) {
3eeb22
     case RSA_PKCS1_PADDING:
3eeb22
@@ -763,7 +751,7 @@ static int RSA_eay_public_decrypt(int fl
3eeb22
         r = RSA_padding_check_X931(to, num, buf, i, num);
3eeb22
         break;
3eeb22
     case RSA_NO_PADDING:
3eeb22
-        r = RSA_padding_check_none(to, num, buf, i, num);
3eeb22
+        memcpy(to, buf, (r = i));
3eeb22
         break;
3eeb22
     default:
3eeb22
         RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);
3eeb22
@@ -789,7 +777,7 @@ static int RSA_eay_mod_exp(BIGNUM *r0, c
3eeb22
     BIGNUM *r1, *m1, *vrfy;
3eeb22
     BIGNUM local_dmp1, local_dmq1, local_c, local_r1;
3eeb22
     BIGNUM *dmp1, *dmq1, *c, *pr1;
3eeb22
-    int ret = 0;
3eeb22
+    int ret = 0, smooth = 0;
3eeb22
 
3eeb22
     BN_CTX_start(ctx);
3eeb22
     r1 = BN_CTX_get(ctx);
3eeb22
@@ -824,6 +812,9 @@ static int RSA_eay_mod_exp(BIGNUM *r0, c
3eeb22
             if (!BN_MONT_CTX_set_locked
3eeb22
                 (&rsa->_method_mod_q, CRYPTO_LOCK_RSA, q, ctx))
3eeb22
                 goto err;
3eeb22
+
3eeb22
+            smooth = (rsa->meth->bn_mod_exp == BN_mod_exp_mont)
3eeb22
+                     && (BN_num_bits(q) == BN_num_bits(p));
3eeb22
         }
3eeb22
     }
3eeb22
 
3eeb22
@@ -832,6 +823,47 @@ static int RSA_eay_mod_exp(BIGNUM *r0, c
3eeb22
             (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))
3eeb22
             goto err;
3eeb22
 
3eeb22
+    if (smooth) {
3eeb22
+        /*
3eeb22
+         * Conversion from Montgomery domain, a.k.a. Montgomery reduction,
3eeb22
+         * accepts values in [0-m*2^w) range. w is m's bit width rounded up
3eeb22
+         * to limb width. So that at the very least if |I| is fully reduced,
3eeb22
+         * i.e. less than p*q, we can count on from-to round to perform
3eeb22
+         * below modulo operations on |I|. Unlike BN_mod it's constant time.
3eeb22
+         */
3eeb22
+        if (/* m1 = I moq q */
3eeb22
+            !bn_from_mont_fixed_top(m1, I, rsa->_method_mod_q, ctx)
3eeb22
+            || !bn_to_mont_fixed_top(m1, m1, rsa->_method_mod_q, ctx)
3eeb22
+            /* m1 = m1^dmq1 mod q */
3eeb22
+            || !BN_mod_exp_mont_consttime(m1, m1, rsa->dmq1, rsa->q, ctx,
3eeb22
+                                          rsa->_method_mod_q)
3eeb22
+            /* r1 = I mod p */
3eeb22
+            || !bn_from_mont_fixed_top(r1, I, rsa->_method_mod_p, ctx)
3eeb22
+            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)
3eeb22
+            /* r1 = r1^dmp1 mod p */
3eeb22
+            || !BN_mod_exp_mont_consttime(r1, r1, rsa->dmp1, rsa->p, ctx,
3eeb22
+                                          rsa->_method_mod_p)
3eeb22
+            /* r1 = (r1 - m1) mod p */
3eeb22
+            /*
3eeb22
+             * bn_mod_sub_fixed_top is not regular modular subtraction,
3eeb22
+             * it can tolerate subtrahend to be larger than modulus, but
3eeb22
+             * not bit-wise wider. This makes up for uncommon q>p case,
3eeb22
+             * when |m1| can be larger than |rsa->p|.
3eeb22
+             */
3eeb22
+            || !bn_mod_sub_fixed_top(r1, r1, m1, rsa->p)
3eeb22
+
3eeb22
+            /* r1 = r1 * iqmp mod p */
3eeb22
+            || !bn_to_mont_fixed_top(r1, r1, rsa->_method_mod_p, ctx)
3eeb22
+            || !bn_mul_mont_fixed_top(r1, r1, rsa->iqmp, rsa->_method_mod_p,
3eeb22
+                                      ctx)
3eeb22
+            /* r0 = r1 * q + m1 */
3eeb22
+            || !bn_mul_fixed_top(r0, r1, rsa->q, ctx)
3eeb22
+            || !bn_mod_add_fixed_top(r0, r0, m1, rsa->n))
3eeb22
+            goto err;
3eeb22
+
3eeb22
+        goto tail;
3eeb22
+    }
3eeb22
+
3eeb22
     /* compute I mod q */
3eeb22
     if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {
3eeb22
         c = &local_c;
3eeb22
@@ -909,10 +941,18 @@ static int RSA_eay_mod_exp(BIGNUM *r0, c
3eeb22
     if (!BN_add(r0, r1, m1))
3eeb22
         goto err;
3eeb22
 
3eeb22
+ tail:
3eeb22
     if (rsa->e && rsa->n) {
3eeb22
-        if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,
3eeb22
-                                   rsa->_method_mod_n))
3eeb22
-            goto err;
3eeb22
+        if (rsa->meth->bn_mod_exp == BN_mod_exp_mont) {
3eeb22
+            if (!BN_mod_exp_mont(vrfy, r0, rsa->e, rsa->n, ctx,
3eeb22
+                                 rsa->_method_mod_n))
3eeb22
+                goto err;
3eeb22
+        } else {
3eeb22
+            bn_correct_top(r0);
3eeb22
+            if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,
3eeb22
+                                       rsa->_method_mod_n))
3eeb22
+                goto err;
3eeb22
+        }
3eeb22
         /*
3eeb22
          * If 'I' was greater than (or equal to) rsa->n, the operation will
3eeb22
          * be equivalent to using 'I mod n'. However, the result of the
3eeb22
@@ -921,6 +961,11 @@ static int RSA_eay_mod_exp(BIGNUM *r0, c
3eeb22
          */
3eeb22
         if (!BN_sub(vrfy, vrfy, I))
3eeb22
             goto err;
3eeb22
+        if (BN_is_zero(vrfy)) {
3eeb22
+            bn_correct_top(r0);
3eeb22
+            ret = 1;
3eeb22
+            goto err;   /* not actually error */
3eeb22
+        }
3eeb22
         if (!BN_mod(vrfy, vrfy, rsa->n, ctx))
3eeb22
             goto err;
3eeb22
         if (BN_is_negative(vrfy))
3eeb22
@@ -946,6 +991,15 @@ static int RSA_eay_mod_exp(BIGNUM *r0, c
3eeb22
                 goto err;
3eeb22
         }
3eeb22
     }
3eeb22
+    /*
3eeb22
+     * It's unfortunate that we have to bn_correct_top(r0). What hopefully
3eeb22
+     * saves the day is that correction is highly unlike, and private key
3eeb22
+     * operations are customarily performed on blinded message. Which means
3eeb22
+     * that attacker won't observe correlation with chosen plaintext.
3eeb22
+     * Secondly, remaining code would still handle it in same computational
3eeb22
+     * time and even conceal memory access pattern around corrected top.
3eeb22
+     */
3eeb22
+    bn_correct_top(r0);
3eeb22
     ret = 1;
3eeb22
  err:
3eeb22
     BN_CTX_end(ctx);
3eeb22
diff -up openssl-1.0.2k/crypto/rsa/rsa_oaep.c.9-lives openssl-1.0.2k/crypto/rsa/rsa_oaep.c
3eeb22
--- openssl-1.0.2k/crypto/rsa/rsa_oaep.c.9-lives	2017-01-26 14:22:03.000000000 +0100
3eeb22
+++ openssl-1.0.2k/crypto/rsa/rsa_oaep.c	2019-04-05 10:50:56.138104353 +0200
3eeb22
@@ -120,8 +120,8 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(un
3eeb22
                                       int plen, const EVP_MD *md,
3eeb22
                                       const EVP_MD *mgf1md)
3eeb22
 {
3eeb22
-    int i, dblen, mlen = -1, one_index = 0, msg_index;
3eeb22
-    unsigned int good, found_one_byte;
3eeb22
+    int i, dblen = 0, mlen = -1, one_index = 0, msg_index;
3eeb22
+    unsigned int good = 0, found_one_byte, mask;
3eeb22
     const unsigned char *maskedseed, *maskeddb;
3eeb22
     /*
3eeb22
      * |em| is the encoded message, zero-padded to exactly |num| bytes: em =
3eeb22
@@ -144,31 +144,42 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(un
3eeb22
      * |num| is the length of the modulus; |flen| is the length of the
3eeb22
      * encoded message. Therefore, for any |from| that was obtained by
3eeb22
      * decrypting a ciphertext, we must have |flen| <= |num|. Similarly,
3eeb22
-     * num < 2 * mdlen + 2 must hold for the modulus irrespective of
3eeb22
+     * |num| >= 2 * |mdlen| + 2 must hold for the modulus irrespective of
3eeb22
      * the ciphertext, see PKCS #1 v2.2, section 7.1.2.
3eeb22
      * This does not leak any side-channel information.
3eeb22
      */
3eeb22
-    if (num < flen || num < 2 * mdlen + 2)
3eeb22
-        goto decoding_err;
3eeb22
+    if (num < flen || num < 2 * mdlen + 2) {
3eeb22
+        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,
3eeb22
+               RSA_R_OAEP_DECODING_ERROR);
3eeb22
+        return -1;
3eeb22
+    }
3eeb22
 
3eeb22
     dblen = num - mdlen - 1;
3eeb22
     db = OPENSSL_malloc(dblen);
3eeb22
-    em = OPENSSL_malloc(num);
3eeb22
-    if (db == NULL || em == NULL) {
3eeb22
+    if (db == NULL) {
3eeb22
         RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, ERR_R_MALLOC_FAILURE);
3eeb22
         goto cleanup;
3eeb22
     }
3eeb22
 
3eeb22
+    em = OPENSSL_malloc(num);
3eeb22
+    if (em == NULL) {
3eeb22
+        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,
3eeb22
+               ERR_R_MALLOC_FAILURE);
3eeb22
+        goto cleanup;
3eeb22
+    }
3eeb22
+
3eeb22
     /*
3eeb22
-     * Always do this zero-padding copy (even when num == flen) to avoid
3eeb22
-     * leaking that information. The copy still leaks some side-channel
3eeb22
-     * information, but it's impossible to have a fixed  memory access
3eeb22
-     * pattern since we can't read out of the bounds of |from|.
3eeb22
-     *
3eeb22
-     * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL.
3eeb22
-     */
3eeb22
-    memset(em, 0, num);
3eeb22
-    memcpy(em + num - flen, from, flen);
3eeb22
+     * Caller is encouraged to pass zero-padded message created with
3eeb22
+     * BN_bn2binpad. Trouble is that since we can't read out of |from|'s
3eeb22
+     * bounds, it's impossible to have an invariant memory access pattern
3eeb22
+     * in case |from| was not zero-padded in advance.
3eeb22
+     */
3eeb22
+    for (from += flen, em += num, i = 0; i < num; i++) {
3eeb22
+        mask = ~constant_time_is_zero(flen);
3eeb22
+        flen -= 1 & mask;
3eeb22
+        from -= 1 & mask;
3eeb22
+        *--em = *from & mask;
3eeb22
+    }
3eeb22
 
3eeb22
     /*
3eeb22
      * The first byte must be zero, however we must not leak if this is
3eeb22
@@ -215,33 +226,53 @@ int RSA_padding_check_PKCS1_OAEP_mgf1(un
3eeb22
      * so plaintext-awareness ensures timing side-channels are no longer a
3eeb22
      * concern.
3eeb22
      */
3eeb22
-    if (!good)
3eeb22
-        goto decoding_err;
3eeb22
-
3eeb22
     msg_index = one_index + 1;
3eeb22
     mlen = dblen - msg_index;
3eeb22
 
3eeb22
-    if (tlen < mlen) {
3eeb22
-        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, RSA_R_DATA_TOO_LARGE);
3eeb22
-        mlen = -1;
3eeb22
-    } else {
3eeb22
-        memcpy(to, db + msg_index, mlen);
3eeb22
-        goto cleanup;
3eeb22
+    /*
3eeb22
+     * For good measure, do this check in constant time as well.
3eeb22
+     */
3eeb22
+    good &= constant_time_ge(tlen, mlen);
3eeb22
+
3eeb22
+    /*
3eeb22
+     * Move the result in-place by |dblen|-|mdlen|-1-|mlen| bytes to the left.
3eeb22
+     * Then if |good| move |mlen| bytes from |db|+|mdlen|+1 to |to|.
3eeb22
+     * Otherwise leave |to| unchanged.
3eeb22
+     * Copy the memory back in a way that does not reveal the size of
3eeb22
+     * the data being copied via a timing side channel. This requires copying
3eeb22
+     * parts of the buffer multiple times based on the bits set in the real
3eeb22
+     * length. Clear bits do a non-copy with identical access pattern.
3eeb22
+     * The loop below has overall complexity of O(N*log(N)).
3eeb22
+     */
3eeb22
+    tlen = constant_time_select_int(constant_time_lt(dblen - mdlen - 1, tlen),
3eeb22
+                                    dblen - mdlen - 1, tlen);
3eeb22
+    for (msg_index = 1; msg_index < dblen - mdlen - 1; msg_index <<= 1) {
3eeb22
+        mask = ~constant_time_eq(msg_index & (dblen - mdlen - 1 - mlen), 0);
3eeb22
+        for (i = mdlen + 1; i < dblen - msg_index; i++)
3eeb22
+            db[i] = constant_time_select_8(mask, db[i + msg_index], db[i]);
3eeb22
+    }
3eeb22
+    for (i = 0; i < tlen; i++) {
3eeb22
+        mask = good & constant_time_lt(i, mlen);
3eeb22
+        to[i] = constant_time_select_8(mask, db[i + mdlen + 1], to[i]);
3eeb22
     }
3eeb22
 
3eeb22
- decoding_err:
3eeb22
     /*
3eeb22
      * To avoid chosen ciphertext attacks, the error message should not
3eeb22
      * reveal which kind of decoding error happened.
3eeb22
      */
3eeb22
     RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,
3eeb22
            RSA_R_OAEP_DECODING_ERROR);
3eeb22
+    err_clear_last_constant_time(1 & good);
3eeb22
  cleanup:
3eeb22
+    OPENSSL_cleanse(seed, sizeof(seed));
3eeb22
     if (db != NULL)
3eeb22
-        OPENSSL_free(db);
3eeb22
+        OPENSSL_cleanse(db, dblen);
3eeb22
+    OPENSSL_free(db);
3eeb22
     if (em != NULL)
3eeb22
-        OPENSSL_free(em);
3eeb22
-    return mlen;
3eeb22
+        OPENSSL_cleanse(em, num);
3eeb22
+    OPENSSL_free(em);
3eeb22
+
3eeb22
+    return constant_time_select_int(good, mlen, -1);
3eeb22
 }
3eeb22
 
3eeb22
 int PKCS1_MGF1(unsigned char *mask, long len,
3eeb22
diff -up openssl-1.0.2k/crypto/rsa/rsa_pk1.c.9-lives openssl-1.0.2k/crypto/rsa/rsa_pk1.c
3eeb22
--- openssl-1.0.2k/crypto/rsa/rsa_pk1.c.9-lives	2017-01-26 14:22:03.000000000 +0100
3eeb22
+++ openssl-1.0.2k/crypto/rsa/rsa_pk1.c	2019-04-05 10:50:56.139104335 +0200
3eeb22
@@ -98,6 +98,27 @@ int RSA_padding_check_PKCS1_type_1(unsig
3eeb22
     const unsigned char *p;
3eeb22
 
3eeb22
     p = from;
3eeb22
+
3eeb22
+    /*
3eeb22
+     * The format is
3eeb22
+     * 00 || 01 || PS || 00 || D
3eeb22
+     * PS - padding string, at least 8 bytes of FF
3eeb22
+     * D  - data.
3eeb22
+     */
3eeb22
+
3eeb22
+    if (num < 11)
3eeb22
+        return -1;
3eeb22
+
3eeb22
+    /* Accept inputs with and without the leading 0-byte. */
3eeb22
+    if (num == flen) {
3eeb22
+        if ((*p++) != 0x00) {
3eeb22
+            RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
3eeb22
+                   RSA_R_INVALID_PADDING);
3eeb22
+            return -1;
3eeb22
+        }
3eeb22
+        flen--;
3eeb22
+    }
3eeb22
+
3eeb22
     if ((num != (flen + 1)) || (*(p++) != 01)) {
3eeb22
         RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
3eeb22
                RSA_R_BLOCK_TYPE_IS_NOT_01);
3eeb22
@@ -186,7 +207,7 @@ int RSA_padding_check_PKCS1_type_2(unsig
3eeb22
     int i;
3eeb22
     /* |em| is the encoded message, zero-padded to exactly |num| bytes */
3eeb22
     unsigned char *em = NULL;
3eeb22
-    unsigned int good, found_zero_byte;
3eeb22
+    unsigned int good, found_zero_byte, mask;
3eeb22
     int zero_index = 0, msg_index, mlen = -1;
3eeb22
 
3eeb22
     if (tlen < 0 || flen < 0)
3eeb22
@@ -197,37 +218,40 @@ int RSA_padding_check_PKCS1_type_2(unsig
3eeb22
      * section 7.2.2.
3eeb22
      */
3eeb22
 
3eeb22
-    if (flen > num)
3eeb22
-        goto err;
3eeb22
-
3eeb22
-    if (num < 11)
3eeb22
-        goto err;
3eeb22
+    if (flen > num || num < 11) {
3eeb22
+        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,
3eeb22
+               RSA_R_PKCS_DECODING_ERROR);
3eeb22
+        return -1;
3eeb22
+    }
3eeb22
 
3eeb22
     em = OPENSSL_malloc(num);
3eeb22
     if (em == NULL) {
3eeb22
         RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);
3eeb22
         return -1;
3eeb22
     }
3eeb22
-    memset(em, 0, num);
3eeb22
     /*
3eeb22
-     * Always do this zero-padding copy (even when num == flen) to avoid
3eeb22
-     * leaking that information. The copy still leaks some side-channel
3eeb22
-     * information, but it's impossible to have a fixed  memory access
3eeb22
-     * pattern since we can't read out of the bounds of |from|.
3eeb22
-     *
3eeb22
-     * TODO(emilia): Consider porting BN_bn2bin_padded from BoringSSL.
3eeb22
-     */
3eeb22
-    memcpy(em + num - flen, from, flen);
3eeb22
+     * Caller is encouraged to pass zero-padded message created with
3eeb22
+     * BN_bn2binpad. Trouble is that since we can't read out of |from|'s
3eeb22
+     * bounds, it's impossible to have an invariant memory access pattern
3eeb22
+     * in case |from| was not zero-padded in advance.
3eeb22
+     */
3eeb22
+    for (from += flen, em += num, i = 0; i < num; i++) {
3eeb22
+        mask = ~constant_time_is_zero(flen);
3eeb22
+        flen -= 1 & mask;
3eeb22
+        from -= 1 & mask;
3eeb22
+        *--em = *from & mask;
3eeb22
+    }
3eeb22
 
3eeb22
     good = constant_time_is_zero(em[0]);
3eeb22
     good &= constant_time_eq(em[1], 2);
3eeb22
 
3eeb22
+    /* scan over padding data */
3eeb22
     found_zero_byte = 0;
3eeb22
     for (i = 2; i < num; i++) {
3eeb22
         unsigned int equals0 = constant_time_is_zero(em[i]);
3eeb22
-        zero_index =
3eeb22
-            constant_time_select_int(~found_zero_byte & equals0, i,
3eeb22
-                                     zero_index);
3eeb22
+
3eeb22
+        zero_index = constant_time_select_int(~found_zero_byte & equals0,
3eeb22
+                                              i, zero_index);
3eeb22
         found_zero_byte |= equals0;
3eeb22
     }
3eeb22
 
3eeb22
@@ -236,7 +260,7 @@ int RSA_padding_check_PKCS1_type_2(unsig
3eeb22
      * If we never found a 0-byte, then |zero_index| is 0 and the check
3eeb22
      * also fails.
3eeb22
      */
3eeb22
-    good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);
3eeb22
+    good &= constant_time_ge(zero_index, 2 + 8);
3eeb22
 
3eeb22
     /*
3eeb22
      * Skip the zero byte. This is incorrect if we never found a zero-byte
3eeb22
@@ -246,30 +270,36 @@ int RSA_padding_check_PKCS1_type_2(unsig
3eeb22
     mlen = num - msg_index;
3eeb22
 
3eeb22
     /*
3eeb22
-     * For good measure, do this check in constant time as well; it could
3eeb22
-     * leak something if |tlen| was assuming valid padding.
3eeb22
+     * For good measure, do this check in constant time as well.
3eeb22
      */
3eeb22
-    good &= constant_time_ge((unsigned int)(tlen), (unsigned int)(mlen));
3eeb22
+    good &= constant_time_ge(tlen, mlen);
3eeb22
 
3eeb22
     /*
3eeb22
-     * We can't continue in constant-time because we need to copy the result
3eeb22
-     * and we cannot fake its length. This unavoidably leaks timing
3eeb22
-     * information at the API boundary.
3eeb22
-     * TODO(emilia): this could be addressed at the call site,
3eeb22
-     * see BoringSSL commit 0aa0767340baf925bda4804882aab0cb974b2d26.
3eeb22
-     */
3eeb22
-    if (!good) {
3eeb22
-        mlen = -1;
3eeb22
-        goto err;
3eeb22
-    }
3eeb22
+     * Move the result in-place by |num|-11-|mlen| bytes to the left.
3eeb22
+     * Then if |good| move |mlen| bytes from |em|+11 to |to|.
3eeb22
+     * Otherwise leave |to| unchanged.
3eeb22
+     * Copy the memory back in a way that does not reveal the size of
3eeb22
+     * the data being copied via a timing side channel. This requires copying
3eeb22
+     * parts of the buffer multiple times based on the bits set in the real
3eeb22
+     * length. Clear bits do a non-copy with identical access pattern.
3eeb22
+     * The loop below has overall complexity of O(N*log(N)).
3eeb22
+     */
3eeb22
+    tlen = constant_time_select_int(constant_time_lt(num - 11, tlen),
3eeb22
+                                    num - 11, tlen);
3eeb22
+    for (msg_index = 1; msg_index < num - 11; msg_index <<= 1) {
3eeb22
+        mask = ~constant_time_eq(msg_index & (num - 11 - mlen), 0);
3eeb22
+        for (i = 11; i < num - msg_index; i++)
3eeb22
+            em[i] = constant_time_select_8(mask, em[i + msg_index], em[i]);
3eeb22
+    }
3eeb22
+    for (i = 0; i < tlen; i++) {
3eeb22
+        mask = good & constant_time_lt(i, mlen);
3eeb22
+        to[i] = constant_time_select_8(mask, em[i + 11], to[i]);
3eeb22
+    }
3eeb22
+
3eeb22
+    OPENSSL_cleanse(em, num);
3eeb22
+    OPENSSL_free(em);
3eeb22
+    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR);
3eeb22
+    err_clear_last_constant_time(1 & good);
3eeb22
 
3eeb22
-    memcpy(to, em + msg_index, mlen);
3eeb22
-
3eeb22
- err:
3eeb22
-    if (em != NULL)
3eeb22
-        OPENSSL_free(em);
3eeb22
-    if (mlen == -1)
3eeb22
-        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,
3eeb22
-               RSA_R_PKCS_DECODING_ERROR);
3eeb22
-    return mlen;
3eeb22
+    return constant_time_select_int(good, mlen, -1);
3eeb22
 }
3eeb22
diff -up openssl-1.0.2k/crypto/rsa/rsa_ssl.c.9-lives openssl-1.0.2k/crypto/rsa/rsa_ssl.c
3eeb22
--- openssl-1.0.2k/crypto/rsa/rsa_ssl.c.9-lives	2017-01-26 14:22:03.000000000 +0100
3eeb22
+++ openssl-1.0.2k/crypto/rsa/rsa_ssl.c	2019-04-05 10:50:56.139104335 +0200
3eeb22
@@ -61,6 +61,7 @@
3eeb22
 #include <openssl bn.h="">
3eeb22
 #include <openssl rsa.h="">
3eeb22
 #include <openssl rand.h="">
3eeb22
+#include "constant_time_locl.h"
3eeb22
 
3eeb22
 int RSA_padding_add_SSLv23(unsigned char *to, int tlen,
3eeb22
                            const unsigned char *from, int flen)
3eeb22
@@ -101,49 +102,119 @@ int RSA_padding_add_SSLv23(unsigned char
3eeb22
     return (1);
3eeb22
 }
3eeb22
 
3eeb22
+/*
3eeb22
+ * Copy of RSA_padding_check_PKCS1_type_2 with a twist that rejects padding
3eeb22
+ * if nul delimiter is not preceded by 8 consecutive 0x03 bytes. It also
3eeb22
+ * preserves error code reporting for backward compatibility.
3eeb22
+ */
3eeb22
 int RSA_padding_check_SSLv23(unsigned char *to, int tlen,
3eeb22
                              const unsigned char *from, int flen, int num)
3eeb22
 {
3eeb22
-    int i, j, k;
3eeb22
-    const unsigned char *p;
3eeb22
+    int i;
3eeb22
+    /* |em| is the encoded message, zero-padded to exactly |num| bytes */
3eeb22
+    unsigned char *em = NULL;
3eeb22
+    unsigned int good, found_zero_byte, mask, threes_in_row;
3eeb22
+    int zero_index = 0, msg_index, mlen = -1, err;
3eeb22
 
3eeb22
-    p = from;
3eeb22
-    if (flen < 10) {
3eeb22
+    if (tlen <= 0 || flen <= 0)
3eeb22
+        return -1;
3eeb22
+
3eeb22
+    if (flen > num || num < 11) {
3eeb22
         RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, RSA_R_DATA_TOO_SMALL);
3eeb22
         return (-1);
3eeb22
     }
3eeb22
-    if ((num != (flen + 1)) || (*(p++) != 02)) {
3eeb22
-        RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, RSA_R_BLOCK_TYPE_IS_NOT_02);
3eeb22
-        return (-1);
3eeb22
-    }
3eeb22
 
3eeb22
-    /* scan over padding data */
3eeb22
-    j = flen - 1;               /* one for type */
3eeb22
-    for (i = 0; i < j; i++)
3eeb22
-        if (*(p++) == 0)
3eeb22
-            break;
3eeb22
-
3eeb22
-    if ((i == j) || (i < 8)) {
3eeb22
-        RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23,
3eeb22
-               RSA_R_NULL_BEFORE_BLOCK_MISSING);
3eeb22
-        return (-1);
3eeb22
-    }
3eeb22
-    for (k = -9; k < -1; k++) {
3eeb22
-        if (p[k] != 0x03)
3eeb22
-            break;
3eeb22
-    }
3eeb22
-    if (k == -1) {
3eeb22
-        RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, RSA_R_SSLV3_ROLLBACK_ATTACK);
3eeb22
-        return (-1);
3eeb22
-    }
3eeb22
+    em = OPENSSL_malloc(num);
3eeb22
+    if (em == NULL) {
3eeb22
+        RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, ERR_R_MALLOC_FAILURE);
3eeb22
+        return -1;
3eeb22
+    }
3eeb22
+    /*
3eeb22
+     * Caller is encouraged to pass zero-padded message created with
3eeb22
+     * BN_bn2binpad. Trouble is that since we can't read out of |from|'s
3eeb22
+     * bounds, it's impossible to have an invariant memory access pattern
3eeb22
+     * in case |from| was not zero-padded in advance.
3eeb22
+     */
3eeb22
+    for (from += flen, em += num, i = 0; i < num; i++) {
3eeb22
+        mask = ~constant_time_is_zero(flen);
3eeb22
+        flen -= 1 & mask;
3eeb22
+        from -= 1 & mask;
3eeb22
+        *--em = *from & mask;
3eeb22
+    }
3eeb22
+
3eeb22
+    good = constant_time_is_zero(em[0]);
3eeb22
+    good &= constant_time_eq(em[1], 2);
3eeb22
+    err = constant_time_select_int(good, 0, RSA_R_BLOCK_TYPE_IS_NOT_02);
3eeb22
+    mask = ~good;
3eeb22
 
3eeb22
-    i++;                        /* Skip over the '\0' */
3eeb22
-    j -= i;
3eeb22
-    if (j > tlen) {
3eeb22
-        RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, RSA_R_DATA_TOO_LARGE);
3eeb22
-        return (-1);
3eeb22
-    }
3eeb22
-    memcpy(to, p, (unsigned int)j);
3eeb22
+    /* scan over padding data */
3eeb22
+    found_zero_byte = 0;
3eeb22
+    threes_in_row = 0;
3eeb22
+    for (i = 2; i < num; i++) {
3eeb22
+        unsigned int equals0 = constant_time_is_zero(em[i]);
3eeb22
+
3eeb22
+        zero_index = constant_time_select_int(~found_zero_byte & equals0,
3eeb22
+                                              i, zero_index);
3eeb22
+        found_zero_byte |= equals0;
3eeb22
+
3eeb22
+        threes_in_row += 1 & ~found_zero_byte;
3eeb22
+        threes_in_row &= found_zero_byte | constant_time_eq(em[i], 3);
3eeb22
+    }
3eeb22
+
3eeb22
+    /*
3eeb22
+     * PS must be at least 8 bytes long, and it starts two bytes into |em|.
3eeb22
+     * If we never found a 0-byte, then |zero_index| is 0 and the check
3eeb22
+     * also fails.
3eeb22
+     */
3eeb22
+    good &= constant_time_ge(zero_index, 2 + 8);
3eeb22
+    err = constant_time_select_int(mask | good, err,
3eeb22
+                                   RSA_R_NULL_BEFORE_BLOCK_MISSING);
3eeb22
+    mask = ~good;
3eeb22
+
3eeb22
+    good &= constant_time_ge(threes_in_row, 8);
3eeb22
+    err = constant_time_select_int(mask | good, err,
3eeb22
+                                   RSA_R_SSLV3_ROLLBACK_ATTACK);
3eeb22
+    mask = ~good;
3eeb22
+
3eeb22
+    /*
3eeb22
+     * Skip the zero byte. This is incorrect if we never found a zero-byte
3eeb22
+     * but in this case we also do not copy the message out.
3eeb22
+     */
3eeb22
+    msg_index = zero_index + 1;
3eeb22
+    mlen = num - msg_index;
3eeb22
+
3eeb22
+    /*
3eeb22
+     * For good measure, do this check in constant time as well.
3eeb22
+     */
3eeb22
+    good &= constant_time_ge(tlen, mlen);
3eeb22
+    err = constant_time_select_int(mask | good, err, RSA_R_DATA_TOO_LARGE);
3eeb22
+
3eeb22
+    /*
3eeb22
+     * Move the result in-place by |num|-11-|mlen| bytes to the left.
3eeb22
+     * Then if |good| move |mlen| bytes from |em|+11 to |to|.
3eeb22
+     * Otherwise leave |to| unchanged.
3eeb22
+     * Copy the memory back in a way that does not reveal the size of
3eeb22
+     * the data being copied via a timing side channel. This requires copying
3eeb22
+     * parts of the buffer multiple times based on the bits set in the real
3eeb22
+     * length. Clear bits do a non-copy with identical access pattern.
3eeb22
+     * The loop below has overall complexity of O(N*log(N)).
3eeb22
+     */
3eeb22
+    tlen = constant_time_select_int(constant_time_lt(num - 11, tlen),
3eeb22
+                                    num - 11, tlen);
3eeb22
+    for (msg_index = 1; msg_index < num - 11; msg_index <<= 1) {
3eeb22
+        mask = ~constant_time_eq(msg_index & (num - 11 - mlen), 0);
3eeb22
+        for (i = 11; i < num - msg_index; i++)
3eeb22
+            em[i] = constant_time_select_8(mask, em[i + msg_index], em[i]);
3eeb22
+    }
3eeb22
+    for (i = 0; i < tlen; i++) {
3eeb22
+        mask = good & constant_time_lt(i, mlen);
3eeb22
+        to[i] = constant_time_select_8(mask, em[i + 11], to[i]);
3eeb22
+    }
3eeb22
+
3eeb22
+    OPENSSL_cleanse(em, num);
3eeb22
+    OPENSSL_free(em);
3eeb22
+    RSAerr(RSA_F_RSA_PADDING_CHECK_SSLV23, err);
3eeb22
+    err_clear_last_constant_time(1 & good);
3eeb22
 
3eeb22
-    return (j);
3eeb22
+    return constant_time_select_int(good, mlen, -1);
3eeb22
 }
3eeb22
diff -up openssl-1.0.2k/doc/crypto/RSA_padding_add_PKCS1_type_1.pod.9-lives openssl-1.0.2k/doc/crypto/RSA_padding_add_PKCS1_type_1.pod
3eeb22
--- openssl-1.0.2k/doc/crypto/RSA_padding_add_PKCS1_type_1.pod.9-lives	2017-01-26 14:22:04.000000000 +0100
3eeb22
+++ openssl-1.0.2k/doc/crypto/RSA_padding_add_PKCS1_type_1.pod	2019-04-05 10:50:56.139104335 +0200
3eeb22
@@ -104,6 +104,18 @@ The RSA_padding_check_xxx() functions re
3eeb22
 recovered data, -1 on error. Error codes can be obtained by calling
3eeb22
 L<err_get_error(3)|err_get_error(3)>.
3eeb22
 
3eeb22
+=head1 WARNING
3eeb22
+
3eeb22
+The RSA_padding_check_PKCS1_type_2() padding check leaks timing
3eeb22
+information which can potentially be used to mount a Bleichenbacher
3eeb22
+padding oracle attack. This is an inherent weakness in the PKCS #1
3eeb22
+v1.5 padding design. Prefer PKCS1_OAEP padding. Otherwise it can
3eeb22
+be recommended to pass zero-padded B<f>, so that B<fl> equals to
3eeb22
+B<rsa_len>, and if fixed by protocol, B<tlen> being set to the
3eeb22
+expected length. In such case leakage would be minimal, it would
3eeb22
+take attacker's ability to observe memory access pattern with byte
3eeb22
+granilarity as it occurs, post-factum timing analysis won't do.
3eeb22
+
3eeb22
 =head1 SEE ALSO
3eeb22
 
3eeb22
 L<rsa_public_encrypt(3)|rsa_public_encrypt(3)>,