commit 8dc7b243ae37b1413770a6bc59625288b4614cc3
author Gilles Peskine <Gilles.Peskine@arm.com> Mon Dec 13 12:32:43 2021 +0100
committer Gilles Peskine <Gilles.Peskine@arm.com> Mon Dec 13 14:15:39 2021 +0100
tree 82cef8a4170faa5f4b2c8c6cb9b16b7401a5d96d
parent 1f0f42f1d16a21d68ded634d3621e8dbac4723c5

mbedtls_cipher_check_tag: zeroize expected tag on tag mismatch

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

library/cipher.c

diff --git a/library/cipher.c b/library/cipher.c
index 57da0b9..348cabf 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -967,6 +967,12 @@
         return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
     }
 
+    /* Status to return on a non-authenticated algorithm. It would make sense
+     * to return MBEDTLS_ERR_CIPHER_INVALID_CONTEXT or perhaps
+     * MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA, but at the time I write this our
+     * unit tests assume 0. */
+    ret = 0;
+
 #if defined(MBEDTLS_GCM_C)
     if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
     {
@@ -981,9 +987,7 @@
 
         /* Check the tag in "constant-time" */
         if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
-            return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
-
-        return( 0 );
+            ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
     }
 #endif /* MBEDTLS_GCM_C */
 
@@ -1003,13 +1007,12 @@
 
         /* Check the tag in "constant-time" */
         if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
-            return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
-
-        return( 0 );
+            ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
     }
 #endif /* MBEDTLS_CHACHAPOLY_C */
 
-    return( 0 );
+    mbedtls_platform_zeroize( check_tag, tag_len );
+    return( ret );
 }
 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */