tree 7594cde27e97c439f3a1b9b8fb6bf58d66bbb5e4
parent 69675d056a7e335c0be907541aaab83de71ea8b5
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1530175115 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1531383633 +0200

Add counter-measure to cache-based Lucky 13

The basis for the Lucky 13 family of attacks is for an attacker to be able to
distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding.
Since our code sets padlen = 0 for invalid padding, the length of the input to
the HMAC function, and the location where we read the MAC, give information
about that.

A local attacker could gain information about that by observing via a
cache attack whether the bytes at the end of the record (at the location of
would-be padding) have been read during MAC verification (computation +
comparison).

Let's make sure they're always read.