From 20d6a17af99ad538db902dbebf16879c0b3de687 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Sat, 31 Aug 2013 16:37:46 +0200 Subject: [PATCH] Make GCM tag check "constant-time" --- library/gcm.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/library/gcm.c b/library/gcm.c index 9c079bddd..104fda3a4 100644 --- a/library/gcm.c +++ b/library/gcm.c @@ -357,15 +357,22 @@ int gcm_auth_decrypt( gcm_context *ctx, unsigned char *output ) { unsigned char check_tag[16]; + size_t i; + int diff; gcm_crypt_and_tag( ctx, GCM_DECRYPT, length, iv, iv_len, add, add_len, input, output, tag_len, check_tag ); - if( memcmp( check_tag, tag, tag_len ) == 0 ) - return( 0 ); + /* Check tag in "constant-time" */ + for( diff = 0, i = 0; i < tag_len; i++ ) + diff |= tag[i] ^ check_tag[i]; - memset( output, 0, length ); + if( diff != 0 ) + { + memset( output, 0, length ); + return( POLARSSL_ERR_GCM_AUTH_FAILED ); + } - return( POLARSSL_ERR_GCM_AUTH_FAILED ); + return( 0 ); } #if defined(POLARSSL_SELF_TEST)