Botan 2.19.1
Crypto and TLS for C&
|
Classes | |
class | Mask |
Functions | |
template<typename T > | |
Mask< T > | conditional_copy_mem (T cnd, T *to, const T *from0, const T *from1, size_t elems) |
template<typename T > | |
void | conditional_swap (bool cnd, T &x, T &y) |
template<typename T > | |
void | conditional_swap_ptr (bool cnd, T &x, T &y) |
secure_vector< uint8_t > | copy_output (CT::Mask< uint8_t > bad_input, const uint8_t input[], size_t input_length, size_t offset) |
template<typename T > | |
void | poison (const T *p, size_t n) |
secure_vector< uint8_t > | strip_leading_zeros (const secure_vector< uint8_t > &in) |
secure_vector< uint8_t > | strip_leading_zeros (const uint8_t in[], size_t length) |
template<typename T > | |
void | unpoison (const T *p, size_t n) |
template<typename T > | |
void | unpoison (T &p) |
|
inline |
Definition at line 363 of file ct_utils.h.
References Botan::CT::Mask< T >::expand().
Referenced by Botan::bigint_monty_redc_16(), Botan::bigint_monty_redc_24(), Botan::bigint_monty_redc_32(), Botan::bigint_monty_redc_4(), Botan::bigint_monty_redc_6(), Botan::bigint_monty_redc_8(), Botan::bigint_sub_abs(), and Botan::BigInt::mod_add().
Definition at line 375 of file ct_utils.h.
References Botan::CT::Mask< T >::expand(), and T.
Referenced by Botan::bigint_sub_abs().
Definition at line 386 of file ct_utils.h.
References T.
Referenced by Botan::bigint_sub_abs().
secure_vector< uint8_t > Botan::CT::copy_output | ( | CT::Mask< uint8_t > | bad_input, |
const uint8_t | input[], | ||
size_t | input_length, | ||
size_t | delim_idx | ||
) |
If bad_mask is unset, return in[delim_idx:input_length] copied to new buffer. If bad_mask is set, return an all zero vector of unspecified length.
Definition at line 13 of file ct_utils.cpp.
References Botan::CT::Mask< T >::if_set_zero_out(), Botan::CT::Mask< T >::is_equal(), Botan::CT::Mask< T >::is_lte(), and unpoison().
Referenced by Botan::oaep_find_delim(), strip_leading_zeros(), and Botan::EME_PKCS1v15::unpad().
Use valgrind to mark the contents of memory as being undefined. Valgrind will accept operations which manipulate undefined values, but will warn if an undefined value is used to decided a conditional jump or a load/store address. So if we poison all of our inputs we can confirm that the operations in question are truly const time when compiled by whatever compiler is in use.
Even better, the VALGRIND_MAKE_MEM_* macros work even when the program is not run under valgrind (though with a few cycles of overhead, which is unfortunate in final binaries as these annotations tend to be used in fairly important loops).
This approach was first used in ctgrind (https://github.com/agl/ctgrind) but calling the valgrind mecheck API directly works just as well and doesn't require a custom patched valgrind.
Definition at line 48 of file ct_utils.h.
References BOTAN_UNUSED, and T.
Referenced by Botan::PKCS7_Padding::add_padding(), Botan::ANSI_X923_Padding::add_padding(), Botan::OneAndZeros_Padding::add_padding(), Botan::ESP_Padding::add_padding(), Botan::BigInt::const_time_lookup(), Botan::curve25519_donna(), Botan::TLS::TLS_CBC_HMAC_AEAD_Decryption::finish(), Botan::oaep_find_delim(), Botan::PKCS7_Padding::unpad(), Botan::ANSI_X923_Padding::unpad(), Botan::OneAndZeros_Padding::unpad(), Botan::ESP_Padding::unpad(), and Botan::EME_PKCS1v15::unpad().
|
inline |
Definition at line 409 of file ct_utils.h.
References strip_leading_zeros().
secure_vector< uint8_t > Botan::CT::strip_leading_zeros | ( | const uint8_t | in[], |
size_t | length | ||
) |
Definition at line 66 of file ct_utils.cpp.
References copy_output(), Botan::CT::Mask< T >::is_zero(), and Botan::CT::Mask< T >::set().
Referenced by Botan::TLS::Client_Key_Exchange::Client_Key_Exchange(), strip_leading_zeros(), and Botan::TLS::Callbacks::tls_dh_agree().
Definition at line 59 of file ct_utils.h.
References BOTAN_UNUSED, and T.
Referenced by Botan::PKCS7_Padding::add_padding(), Botan::ANSI_X923_Padding::add_padding(), Botan::OneAndZeros_Padding::add_padding(), Botan::ESP_Padding::add_padding(), Botan::bigint_cmp(), Botan::BigInt::const_time_lookup(), copy_output(), Botan::curve25519_donna(), Botan::TLS::TLS_CBC_HMAC_AEAD_Decryption::finish(), Botan::gcd(), Botan::oaep_find_delim(), Botan::redc_p192(), Botan::redc_p224(), Botan::redc_p256(), Botan::redc_p384(), Botan::CT::Mask< T >::select_and_unpoison(), Botan::BigInt::top_bits_free(), Botan::PKCS7_Padding::unpad(), Botan::ANSI_X923_Padding::unpad(), Botan::OneAndZeros_Padding::unpad(), Botan::ESP_Padding::unpad(), Botan::EME_PKCS1v15::unpad(), and Botan::CT::Mask< T >::unpoisoned_value().
Definition at line 70 of file ct_utils.h.
References BOTAN_UNUSED, and T.