Tobias Frauenschläger fd13b11755 Use random-witness primality test for untrusted DH modulus ...

wc_DhSetKey_ex loads DH parameters as untrusted and validates that the
modulus is prime, but it passed no RNG, so the check fell back to a
Miller-Rabin test using the fixed small-prime bases 2 through 19. That
test is defeatable: a composite crafted as a strong pseudoprime to those
known bases passes as prime, letting an attacker supply a composite
modulus with a smooth factorization for small-subgroup recovery of the
private exponent and shared secret.

When no RNG is supplied on the untrusted path, create a temporary RNG so
mp_prime_is_prime_ex runs with random witnesses, which such crafted
composites cannot reliably pass. Named FFDHE primes still short-circuit
the check, and builds without an RNG keep the deterministic test.

Fixes F-6776.

2026-08-01 13:13:00 +02:00

..

header_files

Use random-witness primality test for untrusted DH modulus

2026-08-01 13:13:00 +02:00

header_files-ja

Reject identity-point ECDH shared secret

2026-08-01 13:13:00 +02:00