Re: [PATCH] crypto: sa2ul - use crypto_memneq() to compare AEAD tag
Herbert Xu <[email protected]>
| Newsgroups | org.kernel.vger.linux-crypto,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Aug 07, 2026 at 05:44:16PM +0200, David C.C.M. Gall wrote: > Use crypto_memneq() for a constant-time comparison. > > sa_aead_dma_in_callback() compares the computed authentication tag > against the received tag with memcmp(), which short-circuits on the > first differing byte. An attacker who can submit decrypt requests and > observe completion latency could recover the expected tag byte by byte. > > Valid tag forgery for AEAD breaks the INT-CTXT guarantee. > > Assisted-by: gregkh_clanker_t1000 > Signed-off-by: David C.C.M. Gall <[email protected]> > --- > drivers/crypto/sa2ul.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Patch applied. Thanks. -- Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt