From 193c16a3648b8670a762e925b6ac6e074f468a20 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Tue, 22 Jan 2019 16:02:41 -0500 Subject: [PATCH] crypto/elliptic: reduce subtraction term to prevent long busy loop If beta8 is unusually large, the addition loop might take a very long time to bring x3-beta8 back positive. This would lead to a DoS vulnerability in the implementation of the P-521 and P-384 elliptic curves that may let an attacker craft inputs to ScalarMult that consume excessive amounts of CPU. This fixes CVE-2019-6486. Fixes #29903 Change-Id: Ia969e8b5bf5ac4071a00722de9d5e4d856d8071a Reviewed-on: https://team-review.git.corp.google.com/c/399777 Reviewed-by: Adam Langley Reviewed-by: Julie Qiu Reviewed-on: https://go-review.googlesource.com/c/159218 Reviewed-by: Julie Qiu --- src/crypto/elliptic/elliptic.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go index 4fc2b5e5213af..c84657c5e3677 100644 --- a/src/crypto/elliptic/elliptic.go +++ b/src/crypto/elliptic/elliptic.go @@ -210,8 +210,9 @@ func (curve *CurveParams) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int, x3 := new(big.Int).Mul(alpha, alpha) beta8 := new(big.Int).Lsh(beta, 3) + beta8.Mod(beta8, curve.P) x3.Sub(x3, beta8) - for x3.Sign() == -1 { + if x3.Sign() == -1 { x3.Add(x3, curve.P) } x3.Mod(x3, curve.P)