tree 285dba2981f9ea146fbff314eceb0470025afd56
parent 2347d4eb3b9fe14b3368da864545c3747fabfbb9
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1530180627 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1531383633 +0200

Fix Lucky 13 cache attack on MD/SHA padding

The basis for the Lucky 13 family of attacks is for an attacker to be able to
distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding.
Since our code sets padlen = 0 for invalid padding, the length of the input to
the HMAC function gives information about that.

Information about this length (modulo the MD/SHA block size) can be deduced
from how much MD/SHA padding (this is distinct from TLS-CBC padding) is used.
If MD/SHA padding is read from a (static) buffer, a local attacker could get
information about how much is used via a cache attack targeting that buffer.

Let's get rid of this buffer. Now the only buffer used is the internal MD/SHA
one, which is always read fully by the process() function.