Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Exponentiation can leak secret prime information in permitted fast-math configurations, and the inverse check accepts some composite p values that produce invalid RSA keys.
2 open issues
What changed in this PR
This PR changes fwTPM RSA CRT computation to reduce timing exposure from inversions involving secret primes.
Changes:
- Computes the CRT coefficient using modular exponentiation and blinds the private-exponent inversion.
- Threads an RNG through key reconstruction and command callers.
- Adds tests for stable CRT results, missing RNGs, and selected invalid factors.
| File | Description |
|---|---|
wolftpm/fwtpm/fwtpm_crypto.h |
Adds RNG parameters to CRT and reconstruction interfaces. |
tests/fwtpm_unit_tests.c |
Adds CRT consistency and invalid-input tests. |
src/fwtpm/fwtpm_crypto.c |
Implements blinded inversion, exponentiation, and inverse verification. |
src/fwtpm/fwtpm_command.c |
Passes the context RNG from LoadExternal and Import. |
Review effort: Balanced
| } | ||
| if (rc == 0) { | ||
| rc = mp_invmod(&rsaKey->q, &rsaKey->p, &rsaKey->u); | ||
| rc = mp_exptmod(&rsaKey->q, &qm1, &rsaKey->p, &rsaKey->u); |
Comment on lines
+3936
to
+3937
| if (rc == 0 && !mp_isone(&qm1)) { | ||
| rc = MP_VAL; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
FwRsaComputeCRT()no longer usesmp_invmod()on secret values.unow comes frommp_exptmod(q, p-2, p), anddfrom invertingeblinded by a fresh random factor. The resulting key is unchanged.FwRsaComputeCRT()andFwImportReconstructKey()gain an RNG parameter.Behavior change:
TPM2_LoadExternalandTPM2_Importnow reject a key whoseu*q mod pis not 1.ucomes from an exponentiation that is only an inverse for a primep, so this rejects most, but not all, keys with a compositep. Such keys could not perform valid RSA operations.Testing
Tested with the fwTPM and against ibmswtpm2. Not tested on hardware.
Resolves F-17134. ZD 22745.