From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id B4BD2A0471 for ; Wed, 19 Jun 2019 16:48:27 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 824AE1C33B; Wed, 19 Jun 2019 16:48:27 +0200 (CEST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50077.outbound.protection.outlook.com [40.107.5.77]) by dpdk.org (Postfix) with ESMTP id A504C1C310 for ; Wed, 19 Jun 2019 16:48:25 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nxp.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UjQ8lw/1VE8qQ6vxfXDe2Bb6E7TEXtPV33K/MUDxZwc=; b=YXfI0e5FSM3FXf6GhMdXyO8R+K/GpLfksq4VPu5UrA+LWpPd2RLk3LCRjxEzafh48Ajcv4pFad/Glmf78PiUrLtdZhUV57ISFcqv0vjHYRv+juwliw8mCJEXN15Pdh2ZkV8jh5TL1IRq5WXC5BRH0XPwqJ8Vbo70pGP8X0A2Ing= Received: from VE1PR04MB6639.eurprd04.prod.outlook.com (20.179.235.82) by VE1PR04MB6717.eurprd04.prod.outlook.com (20.179.235.206) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.13; Wed, 19 Jun 2019 14:48:24 +0000 Received: from VE1PR04MB6639.eurprd04.prod.outlook.com ([fe80::a929:3d03:7bb7:d5e0]) by VE1PR04MB6639.eurprd04.prod.outlook.com ([fe80::a929:3d03:7bb7:d5e0%7]) with mapi id 15.20.1987.014; Wed, 19 Jun 2019 14:48:24 +0000 From: Akhil Goyal To: "Trahe, Fiona" , "Kusztal, ArkadiuszX" , "dev@dpdk.org" CC: "Doherty, Declan" Thread-Topic: [PATCH] crypto/openssl: fix usage of non constant time memcmp for mac and signature Thread-Index: AQHVF35990foWZLXckqjGqm5b2VbQqaFUjsAgB3at3A= Date: Wed, 19 Jun 2019 14:48:24 +0000 Message-ID: References: <20190531065928.3420-1-arkadiuszx.kusztal@intel.com> <20190531065928.3420-2-arkadiuszx.kusztal@intel.com> <348A99DA5F5B7549AA880327E580B43589778706@IRSMSX101.ger.corp.intel.com> In-Reply-To: <348A99DA5F5B7549AA880327E580B43589778706@IRSMSX101.ger.corp.intel.com> Accept-Language: en-IN, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=akhil.goyal@nxp.com; x-originating-ip: [92.120.1.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 90424d39-aa66-4d1a-c120-08d6f4c52eac x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:VE1PR04MB6717; x-ms-traffictypediagnostic: VE1PR04MB6717: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:3631; x-forefront-prvs: 0073BFEF03 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(376002)(366004)(39860400002)(396003)(13464003)(199004)(189003)(81166006)(76116006)(53546011)(66946007)(6436002)(446003)(102836004)(7696005)(229853002)(486006)(3846002)(476003)(6116002)(110136005)(55016002)(14454004)(44832011)(11346002)(186003)(53936002)(81156014)(2501003)(8676002)(26005)(8936002)(316002)(76176011)(2906002)(5660300002)(33656002)(7736002)(305945005)(478600001)(99286004)(52536014)(4326008)(6506007)(73956011)(9686003)(86362001)(74316002)(14444005)(256004)(6246003)(66556008)(64756008)(66446008)(68736007)(66066001)(66476007)(25786009)(71200400001)(71190400001); DIR:OUT; SFP:1101; SCL:1; SRVR:VE1PR04MB6717; H:VE1PR04MB6639.eurprd04.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: nxp.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: tD13kmwcLpOkL9gSWuyftIcS1cGFUI9yp/+XCyMHGnLrdZFbTBAoXAyzdsS4OQQ/wVOfOCwlkV/jwuiqK5yFI526584USGNfdTeAiESzIMVdJB1aX/WaDCFnmtr6R9Tqdl40+VM0Yp0tE1YaGtsECYSfIUqOLm5pZ1fMqS3QjJxszZPw0FPhV6r1FJ/164eG27ABZS61TBqAPrOp0H7k8SkvY21iiu5imH4/8qZW+bGVPXMW8TDxnj5DPVdams05ULX586JvlCgF+KZOR1aeAiRUTUzFogxYWnDlY87m0YW12PSR8s2/CvDvcViKMMicvKXUM3s5JBmx3FdMzdNi3J5sQmqBF9urc82g/u340i8cqmGBH3vXVbnnJzqqod3s1UudhLrdpoxQOBPawHM9UhoRPWKbc+oAXHGinFNuDOs= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: 90424d39-aa66-4d1a-c120-08d6f4c52eac X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jun 2019 14:48:24.6363 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: akhil.goyal@nxp.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: VE1PR04MB6717 Subject: Re: [dpdk-dev] [PATCH] crypto/openssl: fix usage of non constant time memcmp for mac and signature X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" >=20 >=20 > > -----Original Message----- > > From: Kusztal, ArkadiuszX > > Sent: Friday, May 31, 2019 7:59 AM > > To: dev@dpdk.org > > Cc: akhil.goyal@nxp.com; Trahe, Fiona ; Doherty, > Declan > > ; Kusztal, ArkadiuszX > > > Subject: [PATCH] crypto/openssl: fix usage of non constant time memcmp = for > mac and signature > > > > ANSI C memcmp is not constant time function per spec so it should > > be avoided in cryptography usage. > > > > Fixes: d61f70b4c918 ("crypto/libcrypto: add driver for OpenSSL library"= ) > > > > Signed-off-by: Arek Kusztal > > --- > > drivers/crypto/openssl/rte_openssl_pmd.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/crypto/openssl/rte_openssl_pmd.c > b/drivers/crypto/openssl/rte_openssl_pmd.c > > index 6504959..73ce383 100644 > > --- a/drivers/crypto/openssl/rte_openssl_pmd.c > > +++ b/drivers/crypto/openssl/rte_openssl_pmd.c > > @@ -1529,7 +1529,7 @@ process_openssl_auth_op(struct openssl_qp *qp, > struct rte_crypto_op *op, > > } > > > > if (sess->auth.operation =3D=3D RTE_CRYPTO_AUTH_OP_VERIFY) { > > - if (memcmp(dst, op->sym->auth.digest.data, > > + if (CRYPTO_memcmp(dst, op->sym->auth.digest.data, > > sess->auth.digest_length) !=3D 0) { > > op->status =3D RTE_CRYPTO_OP_STATUS_AUTH_FAILED; > > } > > @@ -1914,7 +1914,7 @@ process_openssl_rsa_op(struct rte_crypto_op *cop, > > "Length of public_decrypt %d " > > "length of message %zd\n", > > ret, op->rsa.message.length); > > - if ((ret <=3D 0) || (memcmp(tmp, op->rsa.message.data, > > + if ((ret <=3D 0) || (CRYPTO_memcmp(tmp, op->rsa.message.data, > > op->rsa.message.length))) { > > OPENSSL_LOG(ERR, "RSA sign Verification failed"); > > cop->status =3D RTE_CRYPTO_OP_STATUS_ERROR; > > -- > > 2.1.0 > Hadn't heard of that time const fn before so just read up on it - interes= ting. > Acked-by: Fiona Trahe >=20 Modified the subject a bit. Applied to dpdk-next-crypto Thanks