mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-10 10:11:26 +02:00
Tobias Frauenschläger
c508b402ca
wc_ecc_shared_secret_gen_sync ran the scalar multiplication and then copied the x-coordinate to the output without checking whether the result was the point at infinity. Both math backends report success for the identity: ecc_map_ex sets x, y to zero and z to one and returns success, and the single precision generators serialize the identity as an all-zero x-coordinate. Either way a shared secret that computed to infinity was handed back as an all-zero secret with a success code, where SP 800-56Ar3 5.7.1.2 requires an error and stop. Check the mapped point on the software path, and detect the all-zero output after the single precision generators, returning ECC_INF_E in both cases. The scan accumulates over the whole buffer so it does not branch on the secret. A key whose private value is resident in an SE050 carries no software scalar, so the software multiply legitimately yields the identity for it. Skip the check for those keys specifically, rather than for a zero scalar: on a prime-order curve a zero scalar is the one way the identity can arise, so exempting it would disable the check for the case it exists to catch. Fixes F-6770.