coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

psa-rsa: fix side channel on invalid padding

Browse Source 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2026-06-01 10:08:52 +02:00
parent 859cf0788d
commit 503c1375c8
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
library/psa_crypto_rsa.c
View File

@ -25,6 +25,7 @@
#include <mbedtls/rsa.h>
#include <mbedtls/error.h>
#include "rsa_internal.h"
#include "constant_time_internal.h"
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
@ -655,7 +656,17 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut
int ret = mbedtls_rsa_rsaes_pkcs1_v15_decrypt(
rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE,
output_length, input, output, output_size);
/* We want to convert ret into a psa status without allowing an
* attacker to distinguish between 0 and invalid padding. Since
* mbedtls_psa_error() is leaky, hide the difference from it. */
mbedtls_ct_condition_t bad_padding = mbedtls_ct_uint_eq(
(mbedtls_ct_uint_t) ret,
(mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_INVALID_PADDING);
ret = mbedtls_ct_error_if(bad_padding, 0, ret);
status = mbedtls_to_psa_error(ret);
status = mbedtls_ct_error_if(bad_padding,
PSA_ERROR_INVALID_PADDING, status);
#else
status = PSA_ERROR_NOT_SUPPORTED;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */