Re: [PATCH] crypto: krb5 - Use constant-time checksum comparison

On Mon, Jul 20, 2026 at 11:13:04AM +0800, Jiangshan Yi wrote:
> The MIC checksum comparison in rfc3961_verify_mic() uses memcmp(),
> whose execution time depends on the position of the first mismatched
> byte. This creates a timing side-channel that could allow an attacker
> to forge Kerberos checksums byte by byte.
> 
> The same crypto/krb5 subsystem already uses crypto_memneq() for the
> equivalent checksum comparison in crypto/krb5enc.c (line 255), making
> the memcmp() in rfc3961_simplified.c an inconsistent oversight.
> 
> Replace memcmp() with crypto_memneq() to perform a constant-time
> comparison, consistent with the rest of the crypto subsystem
> (gcm, ccm, chacha20poly1305, rsassa-pkcs1, etc.). Add an explicit
> <crypto/utils.h> include since this file did not previously pull in
> the crypto_memneq() declaration.
> 
> Signed-off-by: Jiangshan Yi <[email protected]>
> ---
>  crypto/krb5/rfc3961_simplified.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Please explain exactly what secret information might be leaked by
the timing attack.

Thanks,
-- 
Email: Herbert Xu <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt