tree ff2e3ea6185377d2524b84028dcca03616c5cb0f
parent 4601a4c1b1c00fbe507508f0267ec5a9445bb7e5
author Filippo Valsorda <filippo@golang.org> 1548190961 -0500
committer Julie Qiu <julieqiu@google.com> 1548264542 +0000

[release-branch.go1.11-security] crypto/elliptic: reduce subtraction term to prevent long busy loop

If beta8 is unusually large, the addition loop might take a very long
time to bring x3-beta8 back positive.

This would lead to a DoS vulnerability in the implementation of the
P-521 and P-384 elliptic curves that may let an attacker craft inputs
to ScalarMult that consume excessive amounts of CPU.

This fixes CVE-2019-6486.

Change-Id: Ia969e8b5bf5ac4071a00722de9d5e4d856d8071a
Reviewed-on: https://team-review.git.corp.google.com/c/399777
Reviewed-by: Adam Langley <agl@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
(cherry picked from commit 746d6abe2dfb9ce7609f8e1e1a8dcb7e221f423e)
Reviewed-on: https://team-review.git.corp.google.com/c/401142
Reviewed-by: Filippo Valsorda <valsorda@google.com>