summaryrefslogtreecommitdiffstats
path: root/drivers/crypto/nx/nx-aes-gcm.c
diff options
context:
space:
mode:
authorDavid Gstir <david@sigma-star.at>2015-11-15 17:14:41 +0100
committerHerbert Xu <herbert@gondor.apana.org.au>2015-11-16 21:39:23 +0800
commitcb8affb55c7e64816f3effcd9b2fc3268c016fac (patch)
treea4db924f12ad7421f71ca0ca10a374b4eb814267 /drivers/crypto/nx/nx-aes-gcm.c
parent8005c49d9aea74d382f474ce11afbbc7d7130bec (diff)
downloadlinux-cb8affb55c7e64816f3effcd9b2fc3268c016fac.tar.bz2
crypto: nx - Fix timing leak in GCM and CCM decryption
Using non-constant time memcmp() makes the verification of the authentication tag in the decrypt path vulnerable to timing attacks. Fix this by using crypto_memneq() instead. Cc: stable@vger.kernel.org Signed-off-by: David Gstir <david@sigma-star.at> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'drivers/crypto/nx/nx-aes-gcm.c')
-rw-r--r--drivers/crypto/nx/nx-aes-gcm.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/crypto/nx/nx-aes-gcm.c b/drivers/crypto/nx/nx-aes-gcm.c
index eee624f589b6..abd465f479c4 100644
--- a/drivers/crypto/nx/nx-aes-gcm.c
+++ b/drivers/crypto/nx/nx-aes-gcm.c
@@ -21,6 +21,7 @@
#include <crypto/internal/aead.h>
#include <crypto/aes.h>
+#include <crypto/algapi.h>
#include <crypto/scatterwalk.h>
#include <linux/module.h>
#include <linux/types.h>
@@ -418,7 +419,7 @@ mac:
itag, req->src, req->assoclen + nbytes,
crypto_aead_authsize(crypto_aead_reqtfm(req)),
SCATTERWALK_FROM_SG);
- rc = memcmp(itag, otag,
+ rc = crypto_memneq(itag, otag,
crypto_aead_authsize(crypto_aead_reqtfm(req))) ?
-EBADMSG : 0;
}