Re: [PATCH] crypto: ecc - Randomize the initial Z in ecc_make_pub_key()

[Herbert Xu <herbert@gondor.apana.org.au>]

On Sun, Oct 25, 2026 at 10:44:29PM -0500, Erwin Pawliczek wrote:
> ecc_make_pub_key() calls ecc_point_mult() without an initial Z, so the
> final Z, and therefore the input to vli_mod_inv(), is a deterministic
> function of the private key. vli_mod_inv() is not constant time, so
> key generation leaks information about the private key through its
> running time.
> 
> crypto_ecdh_shared_secret() already passes a random initial Z, which
> blinds the inversion input. Do the same in ecc_make_pub_key().
> 
> Key generation is used in the kernel by Bluetooth SMP and TPM2 HMAC
> sessions, which generate ephemeral P-256 keys.
> 
> crypto_kpp_generate_public_key(), KVM guest on an i7-1165G7 (median
> over 4 boots of the best of 9 runs of 300 calls):
> 
>     P-256:   744.9 us ->  753.2 us (+1.1%; within noise)
>     P-384:  1674.2 us -> 1651.6 us (-1.4%; within noise)
> 
> Suggested-by: Ignat Korchagin <ignat@linux.win>
> Signed-off-by: Erwin Pawliczek <pawliczekerwin@gmail.com>
> ---
> Replaces "crypto: ecc - Use constant-time modular inversion in ecc_point_mult()":
> https://lore.kernel.org/all/20260928042641.307683-1-pawliczekerwin@gmail.com/
> 
>  crypto/ecc.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt