tree e97d2be045ec97f1d432cfc0625cfa18f9d1dee6
parent 2f3a5815674ab4cb37e773c521f9e753d43768c0
author Gilles Peskine <Gilles.Peskine@arm.com> 1527595609 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1527595609 +0200

Fix Lucky13 attack protection when using HMAC-SHA-384

As a protection against the Lucky Thirteen attack, the TLS code for
CBC decryption in encrypt-then-MAC mode performs extra MAC
calculations to compensate for variations in message size due to
padding. The amount of extra MAC calculation to perform was based on
the assumption that the bulk of the time is spent in processing
64-byte blocks, which is correct for most supported hashes but not for
SHA-384. Correct the amount of extra work for SHA-384 (and SHA-512
which is currently not used in TLS, and MD2 although no one should
care about that).