From 0abd0fc5d5c353deddd24552f34336a77052dd38 Mon Sep 17 00:00:00 2001 From: Cameron Kaiser Date: Thu, 1 Oct 2020 13:13:56 -0700 Subject: [PATCH] #627: M1631573 --- security/nss/lib/freebl/ec.c | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/security/nss/lib/freebl/ec.c b/security/nss/lib/freebl/ec.c index 12330193a..2a474ca71 100644 --- a/security/nss/lib/freebl/ec.c +++ b/security/nss/lib/freebl/ec.c @@ -723,27 +723,6 @@ ECDSA_SignDigestWithSeed(ECPrivateKey *key, SECItem *signature, goto cleanup; } - /* - ** We do not want timing information to leak the length of k, - ** so we compute k*G using an equivalent scalar of fixed - ** bit-length. - ** Fix based on patch for ECDSA timing attack in the paper - ** by Billy Bob Brumley and Nicola Tuveri at - ** http://eprint.iacr.org/2011/232 - ** - ** How do we convert k to a value of a fixed bit-length? - ** k starts off as an integer satisfying 0 <= k < n. Hence, - ** n <= k+n < 2n, which means k+n has either the same number - ** of bits as n or one more bit than n. If k+n has the same - ** number of bits as n, the second addition ensures that the - ** final value has exactly one more bit than n. Thus, we - ** always end up with a value that exactly one more bit than n. - */ - CHECK_MPI_OK(mp_add(&k, &n, &k)); - if (mpl_significant_bits(&k) <= mpl_significant_bits(&n)) { - CHECK_MPI_OK(mp_add(&k, &n, &k)); - } - /* ** ANSI X9.62, Section 5.3.2, Step 2 **