[PATCH] crypto: octeontx - use crypto_memneq() to check HMAC
"David C.C.M. Gall" <[email protected]>
| Newsgroups | org.kernel.vger.linux-crypto,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
validate_hmac_cipher_null() compares the computed and received HMAC with memcmp(), which short-circuits on the first differing byte and leaks tag-match length via timing. Use crypto_memneq() instead. Because for cipher_null the validated payload is un-encrypted, this valid prefix leak allows for authenticated message forgery. Assisted-by: gregkh_clanker_t1000 Signed-off-by: David C.C.M. Gall <[email protected]> --- drivers/crypto/marvell/octeontx/otx_cptvf_algs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c b/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c index 096be42e9d03..70befbdd442b 100644 --- a/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c +++ b/drivers/crypto/marvell/octeontx/otx_cptvf_algs.c @@ -16,6 +16,7 @@ #include <crypto/sha1.h> #include <crypto/sha2.h> #include <crypto/xts.h> +#include <crypto/utils.h> #include <crypto/scatterwalk.h> #include <linux/sort.h> #include <linux/module.h> @@ -105,9 +106,9 @@ static inline int validate_hmac_cipher_null(struct otx_cpt_req_info *cpt_req) req = container_of(cpt_req->areq, struct aead_request, base); tfm = crypto_aead_reqtfm(req); rctx = aead_request_ctx_dma(req); - if (memcmp(rctx->fctx.hmac.s.hmac_calc, - rctx->fctx.hmac.s.hmac_recv, - crypto_aead_authsize(tfm)) != 0) + if (crypto_memneq(rctx->fctx.hmac.s.hmac_calc, + rctx->fctx.hmac.s.hmac_recv, + crypto_aead_authsize(tfm))) return -EBADMSG; return 0; -- 2.43.0