Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1662851 > unrolled thread

[PATCH 0/6] Constant Time Memory Comparisons Are Important

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/6] Constant Time Memory Comparisons Are Important "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:00 +0200
    [PATCH 3/6] ccree: use constant time memory comparison for macs and tags "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:00 +0200
      Re: [PATCH 3/6] ccree: use constant time memory comparison for macs  and tags Gilad Ben-Yossef <gilad@benyossef.com> - 2017-06-10 09:50 +0200
        Re: [PATCH 3/6] ccree: use constant time memory comparison for macs  and tags "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 13:00 +0200
          Re: [PATCH 3/6] ccree: use constant time memory comparison for macs  and tags Henrique de Moraes Holschuh <hmh@hmh.eng.br> - 2017-06-10 23:50 +0200
    [PATCH 2/6] net/ipv6: use constant time memory comparison for mac "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:10 +0200
    [PATCH 4/6] security/keys: use constant time memory comparison for macs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:10 +0200
      Re: [kernel-hardening] [PATCH 4/6] security/keys: use constant time  memory comparison for macs James Morris <jmorris@namei.org> - 2017-06-14 11:00 +0200
    [PATCH 1/6] sunrpc: use constant time memory comparison for mac "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:10 +0200
    [PATCH 5/6] bluetooth/smp: use constant time memory comparison for secret values "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:10 +0200
      Re: [PATCH 5/6] bluetooth/smp: use constant time memory comparison  for secret values Marcel Holtmann <marcel@holtmann.org> - 2017-06-10 15:50 +0200
    [PATCH 6/6] mac80211/wpa: use constant time memory comparison for MACs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-10 05:10 +0200
      Re: [PATCH 6/6] mac80211/wpa: use constant time memory comparison  for MACs Johannes Berg <johannes@sipsolutions.net> - 2017-06-13 10:30 +0200
        Re: [PATCH 6/6] mac80211/wpa: use constant time memory comparison for MACs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-13 15:30 +0200
    Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Kalle Valo <kvalo@codeaurora.org> - 2017-06-11 10:20 +0200
      Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Kees Cook <keescook@chromium.org> - 2017-06-11 15:40 +0200
        Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Emmanuel Grumbach <egrumbach@gmail.com> - 2017-06-11 22:50 +0200
          Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Emil Lenngren <emil.lenngren@gmail.com> - 2017-06-11 23:40 +0200
            Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Emmanuel Grumbach <egrumbach@gmail.com> - 2017-06-12 07:10 +0200
            Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Arend van Spriel <arend.vanspriel@broadcom.com> - 2017-06-12 09:40 +0200
    Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important Stephan Müller <smueller@chronox.de> - 2017-06-11 23:10 +0200
      Re: [PATCH 0/6] Constant Time Memory Comparisons Are Important "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-11 23:30 +0200
    [PATCH] rsa-pkcs1pad: use constant time memory comparison for MACs "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-11 23:30 +0200
      Re: [PATCH] rsa-pkcs1pad: use constant time memory comparison for  MACs Herbert Xu <herbert@gondor.apana.org.au> - 2017-06-20 05:40 +0200

Page 2 of 2 — ← Prev page 1 [2]

#1663147

Am Samstag, 10. Juni 2017, 04:59:06 CEST schrieb Jason A. Donenfeld:

Hi Jason,

> Whenever you're comparing two MACs, it's important to do this using
> crypto_memneq instead of memcmp. With memcmp, you leak timing information,
> which could then be used to iteratively forge a MAC. This is far too basic
> of a mistake for us to have so pervasively in the year 2017, so let's begin
> cleaning this stuff up. The following 6 locations were found with some
> simple regex greps, but I'm sure more lurk below the surface. If you
> maintain some code or know somebody who maintains some code that deals
> with MACs, tell them to double check which comparison function they're
> using.

Are you planning to send an update to your patch set? If yes, there is another 
one which should be converted too: crypto/rsa-pkcs1pad.c.

Otherwise, I will send a patch converting this one.

Thanks.

Ciao
Stephan

[toc] | [prev] | [next] | [standalone]

#1663150

Hi Stephan,

On Sun, Jun 11, 2017 at 11:06 PM, Stephan Müller <smueller@chronox.de> wrote:
> Are you planning to send an update to your patch set? If yes, there is another
> one which should be converted too: crypto/rsa-pkcs1pad.c.

I just sent an update to this thread patching that, per your
suggestion. Since these issues are expected to be cherry picked by
their respective committer, I figure we can just pile on the patches
here, listing the 0/6 intro email as each patch's parent.

Jason

[toc] | [prev] | [next] | [standalone]

#1663149 — [PATCH] rsa-pkcs1pad: use constant time memory comparison for MACs

Otherwise, we enable all sorts of forgeries via timing attack.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Suggested-by: Stephan Müller <smueller@chronox.de>
Cc: stable@vger.kernel.org
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: linux-crypto@vger.kernel.org
---
 crypto/rsa-pkcs1pad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
index 8baab4307f7b..7830d304dff6 100644
--- a/crypto/rsa-pkcs1pad.c
+++ b/crypto/rsa-pkcs1pad.c
@@ -496,7 +496,7 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)
 		goto done;
 	pos++;
 
-	if (memcmp(out_buf + pos, digest_info->data, digest_info->size))
+	if (crypto_memneq(out_buf + pos, digest_info->data, digest_info->size))
 		goto done;
 
 	pos += digest_info->size;
-- 
2.13.1

[toc] | [prev] | [next] | [standalone]

#1670230 — Re: [PATCH] rsa-pkcs1pad: use constant time memory comparison for MACs

On Sun, Jun 11, 2017 at 11:20:23PM +0200, Jason A. Donenfeld wrote:
> Otherwise, we enable all sorts of forgeries via timing attack.
> 
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> Suggested-by: Stephan Müller <smueller@chronox.de>
> Cc: stable@vger.kernel.org
> Cc: Herbert Xu <herbert@gondor.apana.org.au>
> Cc: linux-crypto@vger.kernel.org

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel

csiph-web