s390x: Disable mod-expo offloading to a crypto card for small exponents

Add a new keyword 'cex_min_bits:<bits>' for the OPENSSL_s390xcap environment
variable to specify the minimum number of bits that the exponent must have
to offload the operation to the crypto card. Operations with smaller exponents
fall back to software calculation. Mod-expo operations with small exponents
are faster in software than via the crypto card.

The default minimum exponent size is 2048 bits, but this can be changed via
the OPENSSL_s390xcap environment variable.

For mod-expo operations the exponent is checked, and for RSA CRT operations
the modulus is checked to have the minimum bit size. RSA public key operations
usually have small exponents, so they are most likely always performed in
software.

Checking the bit size of a BIGNUM may or may not be constant-time, dependent
on the BN_FLG_CONSTTIME flag of the BIGNUM. For RSA CRT operations, the bit
size of the modulus is checked. The modulus is public information, so no
constant-time issue here. For mod-expo operations with the public exponent
it is also not a constant-time issue, because the public exponent is also
public information. For mod-expo operations with the private exponent, the
size of the private exponent is usually the same as the size of the modulus,
which is public information. For DH mod-expo operations with the private key,
the size of the private key is usually dependent on the DH group that is
used, and this is also public information. Nevertheless, private exponents
better have the BN_FLG_CONSTTIME flag set. For RSA this is the case, and for
DH it is also the case when flag DH_FLAG_CACHE_MONT_P is set, which is always
done (dh_init() sets the flag unconditionally). Furthermore, flag
BN_FLG_CONSTTIME is set for the private key in ossl_dh_generate_public_key().

Signed-off-by: Ingo Franzki <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Fri Oct 23 15:20:45 2026
(Merged from https://github.com/openssl/openssl/pull/31630)

1 files changed, 6 insertions, 0 deletions

diff --git a/include/arch/s390x_arch.h b/include/arch/s390x_arch.h
index 5b8e92ec999..334c549767e 100644
--- a/include/arch/s390x_arch.h
+++ b/include/arch/s390x_arch.h
@@ -89,7 +89,13 @@ extern int OPENSSL_s390xcex;
 __attribute__((visibility("hidden")))
 #endif
 extern int OPENSSL_s390xcex_nodev;
+#if defined(__GNUC__) && defined(__linux)
+__attribute__((visibility("hidden")))
 #endif
+extern unsigned int OPENSSL_s390xcex_min_bits;
+#endif
+
+#define S390X_CEX_MIN_BITS_DEFAULT 2048
 
 /* Max number of 64-bit words currently returned by STFLE */
 #define S390X_STFLE_MAX 3