Re: [PATCH 1/2] crypto: keembay - use crypto_memneq() to compare GCM AEAD tags
Herbert Xu <[email protected]>
| Newsgroups | org.kernel.vger.linux-crypto,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Aug 07, 2026 at 06:13:52PM +0200, David C.C.M. Gall wrote: > Use crypto_memneq() for constant-time comparison. > > The GCM path in keembay-ocs-aes-core.c verifes the received > authentication tag with memcmp(), which returns early on the first > mismatched byte. This leaks valid-prefix length and allows for valid > tag forgery which violates the INT-CTXT guarantee of AEAD. > > Assisted-by: gregkh_clanker_t1000 > Signed-off-by: David C.C.M. Gall <[email protected]> > --- > drivers/crypto/intel/keembay/keembay-ocs-aes-core.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) All applied. Thanks. -- Email: Herbert Xu <[email protected]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt