tree c704ae04956e5a74d958a621e564ffadf2488782
parent b39740e934167f34265000dc77a4c6bb37e793e7
author Janos Follath <janos.follath@arm.com> 1535982323 +0100
committer Darryl Green <darryl.green@arm.com> 1539268726 +0100

Bignum: Fix prime validation vulnerability

The input distribution to primality testing functions is completely
different when used for generating primes and when for validating
primes. The constants used in the library are geared towards the prime
generation use case and are weak when used for validation. (Maliciously
constructed composite numbers can pass the test with high probability)

The mbedtls_mpi_is_prime() function is in the public API and although it
is not documented, it is reasonable to assume that the primary use case
is validating primes. The RSA module too uses it for validating key
material.