From c76cfd536e488b1397d5077e667e84339e471fa1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Mon, 8 Jun 2026 11:56:59 +0200 Subject: [PATCH] pk: also fix RSA-opaque v1.5 decrypt side channels MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- library/pk_wrap.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index 45c274aa94..8ecda036c6 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -1512,11 +1512,17 @@ static int rsa_opaque_decrypt(mbedtls_pk_context *pk, } status = psa_asymmetric_decrypt(pk->priv_id, alg, input, ilen, NULL, 0, output, osize, olen); - if (status != PSA_SUCCESS) { - return PSA_PK_RSA_TO_MBEDTLS_ERR(status); - } - - return 0; + /* Translate error codes from PSA to legacy + * Success vs INVALID_PADDING vs BUFFER_TOO_SMALL is sensitive + * (padding oracle attack), so we take care to translate that + * part in constant time. + */ + int problem; + status = mbedtls_rsa_decrypt_decompose_ret( + PSA_ERROR_INVALID_PADDING, MBEDTLS_ERR_RSA_INVALID_PADDING, + PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE, + status, &problem); + return PSA_PK_RSA_TO_MBEDTLS_ERR(status) | problem; } #endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */