yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-11 15:45:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use branch-free size comparison for the padding size

Browse source 
In mbedtls_rsa_rsaes_pkcs1_v15_decrypt, use size_greater_than (which
is based on bitwise operations) instead of the < operator to compare
sizes when the values being compared must not leak. Some compilers
compile < to a branch at least under some circumstances (observed with
gcc 5.4 for arm-gnueabi -O9 on a toy program).
This commit is contained in:
Gilles Peskine 2018-10-04 21:24:21 +02:00
parent a04f8bbd0d
commit cf1253e8f0
1 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
library/rsa.c
View file

@ -1527,7 +1527,7 @@ int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
} }
/* There must be at least 8 bytes of padding. */ /* There must be at least 8 bytes of padding. */
bad |= ( pad_count < 8 ); bad |= size_greater_than( 8, pad_count );
/* If the padding is valid, set plaintext_size to the number of /* If the padding is valid, set plaintext_size to the number of
* remaining bytes after stripping the padding. If the padding * remaining bytes after stripping the padding. If the padding
@ -1541,10 +1541,9 @@ int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
(unsigned) ( ilen - ( p - buf ) ) ); (unsigned) ( ilen - ( p - buf ) ) );
/* Set output_too_large to 0 if the plaintext fits in the output /* Set output_too_large to 0 if the plaintext fits in the output
* buffer and to 1 otherwise. This is the sign bit (1 for negative) * buffer and to 1 otherwise. */
* of (output_max_len - plaintext_size). */ output_too_large = size_greater_than( plaintext_size,
output_too_large = ( ( output_max_len - plaintext_size ) >> plaintext_max_size );
( ( sizeof( output_max_len ) * 8 - 1 ) ) );
/* Set ret without branches to avoid timing attacks. Return: /* Set ret without branches to avoid timing attacks. Return:
* - INVALID_PADDING if the padding is bad (bad != 0). * - INVALID_PADDING if the padding is bad (bad != 0).