tree a8dfe5d9a25d78f82c55550284eca2906e2b959e
parent 62da8ac37ac1c16cb98c919c957418615f9bec35
author Gilles Peskine <Gilles.Peskine@arm.com> 1618340950 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1622811023 +0200

Fix non-constant-time comparison in mbedtls_mpi_random

Calling mbedtls_mpi_cmp_int reveals the number of leading zero limbs
to an adversary who is capable of very fine-grained timing
measurements. This is very little information, but could be practical
with secp521r1 (1/512 chance of the leading limb being 0) if the
adversary can measure the precise timing of a large number of
signature operations.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>