[release-branch.go1.17] crypto/elliptic: tolerate zero-padded scalars in generic...

Updates #52075
Fixes #52076
Fixes CVE-2022-28327

Change-Id: I595a7514c9a0aa1b9c76aedfc2307e1124271f27
Reviewed-on: https://go-review.googlesource.com/c/go/+/397136
Trust: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Julie Qiu <julie@golang.org>

diff --git a/src/crypto/elliptic/p256.go b/src/crypto/elliptic/p256.go
index b2b12c8f138bfeace215e47cc36cc2f3a5b33df6..da5283735c97e890e57b705b3c87a2723823873d 100644 (file)
--- a/src/crypto/elliptic/p256.go
+++ b/src/crypto/elliptic/p256.go
@@ -52,7 +52,7 @@ func p256GetScalar(out *[32]byte, in []byte) {
        n := new(big.Int).SetBytes(in)
        var scalarBytes []byte
 
-       if n.Cmp(p256Params.N) >= 0 {
+       if n.Cmp(p256Params.N) >= 0 || len(in) > len(out) {
                n.Mod(n, p256Params.N)
                scalarBytes = n.Bytes()
        } else {

diff --git a/src/crypto/elliptic/p256_test.go b/src/crypto/elliptic/p256_test.go
index 1435f5e1a58a8f9a7f1a9cffe7d5ca03f08f79c7..694186df8137232499fb853562b75d827914f014 100644 (file)
--- a/src/crypto/elliptic/p256_test.go
+++ b/src/crypto/elliptic/p256_test.go
@@ -153,3 +153,17 @@ func TestP256CombinedMult(t *testing.T) {
                t.Errorf("1×G + (-1)×G = (%d, %d), should be ∞", x, y)
        }
 }
+
+func TestIssue52075(t *testing.T) {
+       Gx, Gy := P256().Params().Gx, P256().Params().Gy
+       scalar := make([]byte, 33)
+       scalar[32] = 1
+       x, y := P256().ScalarBaseMult(scalar)
+       if x.Cmp(Gx) != 0 || y.Cmp(Gy) != 0 {
+               t.Errorf("unexpected output (%v,%v)", x, y)
+       }
+       x, y = P256().ScalarMult(Gx, Gy, scalar)
+       if x.Cmp(Gx) != 0 || y.Cmp(Gy) != 0 {
+               t.Errorf("unexpected output (%v,%v)", x, y)
+       }
+}