tree d6a4b3c79dd621c5898571ca0bf16d62b80cfa15
parent d37e0c4639c66f7bb4b6e2c039c96304b7536185
author David Horstmann <david.horstmann@arm.com> 1737395040 +0000
committer David Horstmann <david.horstmann@arm.com> 1737545776 +0000

Fix timing side-channel in PKCS7 padding

Previously, we were checking if the last padding byte was in the range
1-16 and returning early if not. This was to prevent an integer overflow
in the output length.

Instead, do the checks in constant-time and conditionally set the output
length based on whether the padding is correct or not, preventing both
the side-channel and the integer overflow.

Signed-off-by: David Horstmann <david.horstmann@arm.com>