tree 8ed892ae972a74d6c27be4889f256d3ac6c51850
parent cd500f38322ba253342d98a52891162506bc1c32
author Gilles Peskine <Gilles.Peskine@arm.com> 1538513081 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1538992155 +0200

Fix a timing-based Bleichenbacher attack on PKCS#1v1.5 decryption

mbedtls_rsa_rsaes_pkcs1_v15_decrypt took care of calculating the
padding length without leaking the amount of padding or the validity
of the padding. However it then skipped the copying of the data if the
padding was invalid, which could allow an adversary to find out
whether the padding was valid through precise timing measurements,
especially if for a local attacker who could observe memory access via
cache timings.

Avoid this leak by always copying from the decryption buffer to the
output buffer, even when the padding is invalid. With invalid padding,
copy the same amount of data as what is expected on valid padding: the
minimum valid padding size if this fits in the output buffer,
otherwise the output buffer size. To avoid leaking payload data from
an unsuccessful decryption, zero the decryption buffer before copying
if the padding was invalid.