diff options
| author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-04-24 13:06:45 +0200 |
|---|---|---|
| committer | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2017-04-24 14:15:54 +0200 |
| commit | d321acbafe210bbcb3b026e4fbd69b1bd274b4b5 (patch) | |
| tree | 2a2b324993c270968b16b4c408bfc4b8e06a245f | |
| parent | a6e75a093f03f918d2a4bd1ff645721097a1c1eb (diff) | |
| download | gnutls-d321acbafe210bbcb3b026e4fbd69b1bd274b4b5.tar.gz | |
fips140-2: enhanced check of generated parameters
That is, replaced all assert() calls with if statements to allow
gracefull fail.
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
| -rw-r--r-- | lib/nettle/int/rsa-keygen-fips186.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/lib/nettle/int/rsa-keygen-fips186.c b/lib/nettle/int/rsa-keygen-fips186.c index 8c207efd73..9bafc10186 100644 --- a/lib/nettle/int/rsa-keygen-fips186.c +++ b/lib/nettle/int/rsa-keygen-fips186.c @@ -27,7 +27,6 @@ #include "config.h" #endif -#include <assert.h> #include <stdlib.h> #include <stdio.h> #include <string.h> @@ -345,10 +344,16 @@ _rsa_generate_fips186_4_keypair(struct rsa_public_key *pub, mpz_mul(pub->n, key->p, key->q); - assert(mpz_sizeinbase(pub->n, 2) == n_size); + if (mpz_sizeinbase(pub->n, 2) != n_size) { + ret = 0; + goto cleanup; + } /* c = q^{-1} (mod p) */ - assert(mpz_invert(key->c, key->q, key->p) != 0); + if (mpz_invert(key->c, key->q, key->p) == 0) { + ret = 0; + goto cleanup; + } mpz_sub_ui(p1, key->p, 1); mpz_sub_ui(q1, key->q, 1); @@ -370,7 +375,10 @@ _rsa_generate_fips186_4_keypair(struct rsa_public_key *pub, /* c was computed earlier */ pub->size = key->size = (n_size + 7) / 8; - assert(pub->size >= RSA_MINIMUM_N_OCTETS); + if (pub->size < RSA_MINIMUM_N_OCTETS) { + ret = 0; + goto cleanup; + } ret = 1; cleanup: |