coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

psa-rsa: also protect OUTPUT_TOO_LARGE

Browse Source 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2026-06-01 12:49:33 +02:00
parent f1dc979f27
commit 682d8f3e89
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
library/psa_crypto_rsa.c
View File

@ -658,15 +658,23 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut
output_length, input, output, output_size);
/* We want to convert ret into a psa status without allowing an
* attacker to distinguish between 0 and invalid padding. Since
* mbedtls_psa_error() is leaky, hide the difference from it. */
* attacker to distinguish between 0, invalid padding, or buffer too
* small. (It's OK if the attacker distinguishes between one of the
* above three and other status such as out of memory.) Since
* mbedtls_to_psa_error() is leaky, hide the difference from it. */
mbedtls_ct_condition_t bad_padding = mbedtls_ct_uint_eq(
(mbedtls_ct_uint_t) ret,
(mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_INVALID_PADDING);
mbedtls_ct_condition_t large_msg = mbedtls_ct_uint_eq(
(mbedtls_ct_uint_t) ret,
(mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE);
ret = mbedtls_ct_error_if(bad_padding, 0, ret);
ret = mbedtls_ct_error_if(large_msg, 0, ret);
status = mbedtls_to_psa_error(ret);
status = mbedtls_ct_error_if(bad_padding,
PSA_ERROR_INVALID_PADDING, status);
status = mbedtls_ct_error_if(large_msg,
PSA_ERROR_BUFFER_TOO_SMALL, status);
#else
status = PSA_ERROR_NOT_SUPPORTED;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */