tree c0983693f8f34bf9f01b37a140addbc3966fae44
parent 5fcfd0345df36ab41134c7b0020cba34008fe16f
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1530175115 +0200
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> 1531383517 +0200

Add counter-measure to cache-based Lucky 13

The basis for the Lucky 13 family of attacks is for an attacker to be able to
distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding.
Since our code sets padlen = 0 for invalid padding, the length of the input to
the HMAC function, and the location where we read the MAC, give information
about that.

A local attacker could gain information about that by observing via a
cache attack whether the bytes at the end of the record (at the location of
would-be padding) have been read during MAC verification (computation +
comparison).

Let's make sure they're always read.