tree 097929789cb27729e2ea46fbf17daf1760bc89f2
parent 2036508538d46a80576f05d7c241a21927622e74
author Gilles Peskine <Gilles.Peskine@arm.com> 1538680710 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1538991530 +0200

Bleichenbacher fix: don't leak the plaintext length (step 2)

Replace memmove(to, to + offset, length) by a functionally equivalent
function that strives to make the same memory access patterns
regardless of the value of length. This fixes an information leak
through timing (especially timing of memory accesses via cache probes)
that leads to a Bleichenbacher-style attack on PKCS#1 v1.5 decryption
using the plaintext length as the observable.