tree 3df9d649c4e495323f57f1545aeb245d219cd251
parent b473916dcff02c39cd289549b8bc061aff6b50e7
author Gilles Peskine <Gilles.Peskine@arm.com> 1538673223 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1538992155 +0200

Bleichenbacher fix: don't leak the plaintext length (step 1)

mbedtls_rsa_rsaes_pkcs1_v15_decrypt takes care not to reveal whether
the padding is valid or not, even through timing or memory access
patterns. This is a defense against an attack published by
Bleichenbacher. The attacker can also obtain the same information by
observing the length of the plaintext. The current implementation
leaks the length of the plaintext through timing and memory access
patterns.

This commit is a first step towards fixing this leak. It reduces the
leak to a single memmove call inside the working buffer.