From 503c1375c81ee1eb4d45f04b6af439a7e45fbc60 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 1 Jun 2026 10:08:52 +0200 Subject: [PATCH] psa-rsa: fix side channel on invalid padding MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- library/psa_crypto_rsa.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/library/psa_crypto_rsa.c b/library/psa_crypto_rsa.c index 5413e9893c..170774ee1a 100644 --- a/library/psa_crypto_rsa.c +++ b/library/psa_crypto_rsa.c @@ -25,6 +25,7 @@ #include #include #include "rsa_internal.h" +#include "constant_time_internal.h" #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \ defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \ @@ -655,7 +656,17 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut int ret = mbedtls_rsa_rsaes_pkcs1_v15_decrypt( rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE, output_length, input, output, output_size); + + /* We want to convert ret into a psa status without allowing an + * attacker to distinguish between 0 and invalid padding. Since + * mbedtls_psa_error() is leaky, hide the difference from it. */ + mbedtls_ct_condition_t bad_padding = mbedtls_ct_uint_eq( + (mbedtls_ct_uint_t) ret, + (mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_INVALID_PADDING); + ret = mbedtls_ct_error_if(bad_padding, 0, ret); status = mbedtls_to_psa_error(ret); + status = mbedtls_ct_error_if(bad_padding, + PSA_ERROR_INVALID_PADDING, status); #else status = PSA_ERROR_NOT_SUPPORTED; #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */