diff --git a/IDE/ROWLEY-CROSSWORKS-ARM/user_settings.h b/IDE/ROWLEY-CROSSWORKS-ARM/user_settings.h index ad720b32b..b9f3ae150 100644 --- a/IDE/ROWLEY-CROSSWORKS-ARM/user_settings.h +++ b/IDE/ROWLEY-CROSSWORKS-ARM/user_settings.h @@ -120,6 +120,11 @@ extern "C" { /* half as much memory but twice as slow */ #undef RSA_LOW_MEM //#define RSA_LOW_MEM + + /* Enables blinding mode, to prevent timing attacks */ + #undef WC_RSA_BLINDING + #define WC_RSA_BLINDING + #else #define NO_RSA #endif diff --git a/configure.ac b/configure.ac index 9666232d7..f7fde4d59 100644 --- a/configure.ac +++ b/configure.ac @@ -408,6 +408,8 @@ AC_ARG_ENABLE([harden], if test "$ENABLED_HARDEN" = "yes" then AM_CFLAGS="$AM_CFLAGS -DTFM_TIMING_RESISTANT -DECC_TIMING_RESISTANT -DWC_RSA_BLINDING" +else + AM_CFLAGS="$AM_CFLAGS -DWC_NO_HARDEN" fi diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index 8e6777d0e..945a5110a 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -1596,6 +1596,21 @@ extern void uITRON4_free(void *p) ; #define ED25519_SMALL #endif + +/* warning for not using harden build options (default with ./configure) */ +#ifndef WC_NO_HARDEN + #if (defined(USE_FAST_MATH) && !defined(TFM_TIMING_RESISTANT)) || \ + (defined(HAVE_ECC) && !defined(ECC_TIMING_RESISTANT)) || \ + (!defined(NO_RSA) && !defined(WC_RSA_BLINDING)) + + #ifndef _MSC_VER + #warning "For timing resistance / side-channel attack prevention consider using harden options" + #else + #pragma message("Warning: For timing resistance / side-channel attack prevention consider using harden options") + #endif + #endif +#endif + #ifdef __cplusplus } /* extern "C" */ #endif