Fix an off-by-one in dsa_check_key()

The private key is a random number in [1, q-1], so 1 must be allowed.
Since q is at least an 160-bit prime and 2^159 + 1 is not prime (159
is not a power of 2), the probability that this is hit is < 2^-159,
but a tiny little bit wrong is still wrong.

Found while investigating a report by bluhm
ok jsing

diff --git a/lib/libcrypto/dsa/dsa_lib.c b/lib/libcrypto/dsa/dsa_lib.c
index 1a6ca54..6986f9a 100644 (file)
--- a/lib/libcrypto/dsa/dsa_lib.c
+++ b/lib/libcrypto/dsa/dsa_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_lib.c,v 1.41 2023/03/07 09:27:10 jsing Exp $ */
+/* $OpenBSD: dsa_lib.c,v 1.42 2023/03/11 15:29:03 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -487,7 +487,7 @@ dsa_check_key(const DSA *dsa)
 
        /* The private key must be nonzero and in GF(q). */
        if (dsa->priv_key != NULL) {
-               if (BN_cmp(dsa->priv_key, BN_value_one()) <= 0 ||
+               if (BN_cmp(dsa->priv_key, BN_value_one()) < 0 ||
                    BN_cmp(dsa->priv_key, dsa->q) >= 0) {
                        DSAerror(DSA_R_INVALID_PARAMETERS);
                        return 0;