sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-07-06 15:51:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] Correct maximum length of FFDHE prime modulus

Browse Source 
Commit 70d63be ("[crypto] Add RFC 3526 FFDHE key exchange algorithms")
defined FFDHE_LEN as a fixed value (rather than deriving it from the
stored length of the Euler constant) and accidentally expressed it as
a bit length rather than a byte length, resulting in substantial
amounts of wasted space.

Fix the maximum length of the modulus and add static assertions to
ensure that the two constants are exactly the required size for this
length.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2026-06-25 12:03:54 +01:00
parent 327378a764
commit 0a92256530
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/crypto/ffdhe.c
+7 -3
View File
@@ -52,7 +52,7 @@ FILE_SECBOOT ( PERMITTED );
#include <ipxe/ffdhe.h>
/** Maximum length of FFDHE prime modulus */
#define FFDHE_LEN 4096
#define FFDHE_LEN 512
/** Maximum length of group constant portion of FFDHE prime modulus */
#define FFDHE_CONSTANT_LEN \
@@ -68,7 +68,7 @@ FILE_SECBOOT ( PERMITTED );
} __attribute__ (( packed ))
/** Euler's constant ("e") */
static const uint8_t euler[FFDHE_CONSTANT_LEN] = {
static const uint8_t euler[] = {
0xad, 0xf8, 0x54, 0x58, 0xa2, 0xbb, 0x4a, 0x9a, 0xaf, 0xdc, 0x56,
0x20, 0x27, 0x3d, 0x3c, 0xf1, 0xd8, 0xb9, 0xc5, 0x83, 0xce, 0x2d,
0x36, 0x95, 0xa9, 0xe1, 0x36, 0x41, 0x14, 0x64, 0x33, 0xfb, 0xcc,
@@ -117,7 +117,7 @@ static const uint8_t euler[FFDHE_CONSTANT_LEN] = {
};
/** Constant "pi" */
static const uint8_t pi[FFDHE_CONSTANT_LEN] = {
static const uint8_t pi[] = {
0xc9, 0x0f, 0xda, 0xa2, 0x21, 0x68, 0xc2, 0x34, 0xc4, 0xc6, 0x62,
0x8b, 0x80, 0xdc, 0x1c, 0xd1, 0x29, 0x02, 0x4e, 0x08, 0x8a, 0x67,
0xcc, 0x74, 0x02, 0x0b, 0xbe, 0xa6, 0x3b, 0x13, 0x9b, 0x22, 0x51,
@@ -208,6 +208,10 @@ static int ffdhe ( struct ffdhe_group *group, const void *public,
bigint_t ( expsize ) exponent;
static const uint8_t two[1] = { 2 };
/* Sanity checks */
static_assert ( sizeof ( euler ) == FFDHE_CONSTANT_LEN );
static_assert ( sizeof ( pi ) == FFDHE_CONSTANT_LEN );
/* Construct modulus */
assert ( sizeof ( *tmp ) == len );
memset ( tmp, 0xff, sizeof ( *tmp ) );