commit 60d8b98d4844475884b4a585cf38ac8a26184d91
author Gilles Peskine <Gilles.Peskine@arm.com> Mon Mar 29 22:28:21 2021 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> Thu Jun 03 18:10:04 2021 +0200
tree 51bf6a070f4a5a35fdd56bd0865ac3d2706bc13d
parent fdc58c1e8b54455f48a7e6d0f374f009205a8686

Preserve MBEDTLS_ERR_ECP_RANDOM_FAILED in case of a hostile RNG

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

library/ecp.c

diff --git a/library/ecp.c b/library/ecp.c
index 3e5cebc..30d4d19 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -3091,6 +3091,22 @@
 }
 #endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
 
+#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
+static int mbedtls_ecp_gen_privkey_sw(
+    const mbedtls_mpi *N, mbedtls_mpi *d,
+    int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
+{
+    int ret = mbedtls_mpi_random( d, 1, N, f_rng, p_rng );
+    switch( ret )
+    {
+        case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
+            return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
+        default:
+            return( ret );
+    }
+}
+#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
+
 /*
  * Generate a private key
  */
@@ -3110,7 +3126,7 @@
 
 #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
     if( mbedtls_ecp_get_type( grp ) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS )
-        return( mbedtls_mpi_random( d, 1, &grp->N, f_rng, p_rng ) );
+        return( mbedtls_ecp_gen_privkey_sw( &grp->N, d, f_rng, p_rng ) );
 #endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
 
     return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );