[release-branch.go1.22] crypto/internal/fips140/nistec: make p256NegCond constant...

Remove the branching instruction from p256NegCond which made it variable
time. The technique used matches that used in p256MovCond.

Fixes #71383
Fixes #71422
Fixes CVE-2025-22866

Change-Id: Ibc2a46814d856cbbdaf6cc0c5a415ed5d42ca793
Reviewed-on: https://go-review.googlesource.com/c/go/+/643735
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Paul Murphy <murp@ibm.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit 6fc23a3cff5e38ff72923fee50f51254dcdc6e93)
Reviewed-on: https://go-review.googlesource.com/c/go/+/645535
Reviewed-by: Carlos Amedee <carlos@golang.org>
TryBot-Bypass: Carlos Amedee <carlos@golang.org>

diff --git a/src/crypto/internal/nistec/p256_asm_ppc64le.s b/src/crypto/internal/nistec/p256_asm_ppc64le.s
index 6b787609b9994e4a5b12b48de3e93e9e829ec7ab..6e89277552cb0a13a3d1f6f542c294a64e21fe7b 100644 (file)
--- a/src/crypto/internal/nistec/p256_asm_ppc64le.s
+++ b/src/crypto/internal/nistec/p256_asm_ppc64le.s
@@ -124,14 +124,23 @@ GLOBL p256mul<>(SB), 8, $160
 #define PH    V31
 
 #define CAR1  V6
+
+#define SEL    V8
+#define ZER    V9
+
 // func p256NegCond(val *p256Point, cond int)
 TEXT ·p256NegCond(SB), NOSPLIT, $0-16
        MOVD val+0(FP), P1ptr
        MOVD $16, R16
 
-       MOVD cond+8(FP), R6
-       CMP  $0, R6
-       BC   12, 2, LR      // just return if cond == 0
+       // Copy cond into SEL (cond is R1 + 8 (cond offset) + 32)
+       MOVD $40, R17
+       LXVDSX (R1)(R17), SEL
+       // Zeroize ZER
+       VSPLTISB $0, ZER
+       // SEL controls whether to return the original value (Y1H/Y1L)
+       // or the negated value (T1H/T1L).
+       VCMPEQUD SEL, ZER, SEL
 
        MOVD $p256mul<>+0x00(SB), CPOOL
 
@@ -148,6 +157,9 @@ TEXT ·p256NegCond(SB), NOSPLIT, $0-16
        VSUBUQM  PL, Y1L, T1L       // subtract part2 giving result
        VSUBEUQM PH, Y1H, CAR1, T1H // subtract part1 using carry from part2
 
+       VSEL T1H, Y1H, SEL, T1H
+       VSEL T1L, Y1L, SEL, T1L
+
        XXPERMDI T1H, T1H, $2, T1H
        XXPERMDI T1L, T1L, $2, T1L
 
@@ -164,6 +176,8 @@ TEXT ·p256NegCond(SB), NOSPLIT, $0-16
 #undef PL
 #undef PH
 #undef CAR1
+#undef SEL
+#undef ZER
 
 #define P3ptr   R3
 #define P1ptr   R4