diffie-hellman: Don't set exponent length for DH groups with prime order subgroups
authorTobias Brunner <tobias@strongswan.org>
Tue, 13 Mar 2018 11:13:47 +0000 (12:13 +0100)
committerTobias Brunner <tobias@strongswan.org>
Wed, 21 Mar 2018 09:21:32 +0000 (10:21 +0100)
According to RFC 5114 the exponent length for these groups should always equal
the size of their prime order subgroup.
This was handled correctly before the initialization was done during
library initialization.

Fixes: 46184b07c163 ("diffie-hellman: Explicitly initialize DH exponent sizes during initialization")

src/libstrongswan/crypto/diffie_hellman.c

index 820b8d1..8127340 100644 (file)
@@ -449,6 +449,12 @@ void diffie_hellman_init()
        {
                for (i = 0; i < countof(dh_params); i++)
                {
+                       /* according to RFC 5114 the size of the exponent for these DH
+                        * groups should equal the size of their prime order subgroup */
+                       if (dh_params[i].public.subgroup.len)
+                       {
+                               continue;
+                       }
                        dh_params[i].public.exp_len = dh_params[i].public.prime.len;
                }
        }