timing resistant pad verification
| 1145 | |
| 1146 | // timing resistant pad verification |
| 1147 | static int timing_verify(SSL& ssl, const byte* input, int padLen, int t, |
| 1148 | int pLen) |
| 1149 | { |
| 1150 | byte verify[SHA_LEN]; |
| 1151 | byte dummy[MAX_PAD_SIZE]; |
| 1152 | |
| 1153 | memset(dummy, 1, sizeof(dummy)); |
| 1154 | |
| 1155 | if ( (t + padLen + 1) > pLen) { |
| 1156 | pad_check(dummy, (byte)padLen, MAX_PAD_SIZE); |
| 1157 | if (ssl.isTLS()) |
| 1158 | TLS_hmac(ssl, verify, input, pLen - t, application_data, 1); |
| 1159 | else |
| 1160 | hmac(ssl, verify, input, pLen - t, application_data, 1); |
| 1161 | constant_compare(verify, input + pLen - t, t); |
| 1162 | |
| 1163 | return -1; |
| 1164 | } |
| 1165 | |
| 1166 | if (pad_check(input + pLen - (padLen + 1), (byte)padLen, padLen + 1) != 0) { |
| 1167 | pad_check(dummy, (byte)padLen, MAX_PAD_SIZE - padLen - 1); |
| 1168 | if (ssl.isTLS()) |
| 1169 | TLS_hmac(ssl, verify, input, pLen - t, application_data, 1); |
| 1170 | else |
| 1171 | hmac(ssl, verify, input, pLen - t, application_data, 1); |
| 1172 | constant_compare(verify, input + pLen - t, t); |
| 1173 | |
| 1174 | return -1; |
| 1175 | } |
| 1176 | |
| 1177 | pad_check(dummy, (byte)padLen, MAX_PAD_SIZE - padLen - 1); |
| 1178 | if (ssl.isTLS()) |
| 1179 | TLS_hmac(ssl, verify, input, pLen - padLen - 1 - t, application_data,1); |
| 1180 | else |
| 1181 | hmac(ssl, verify, input, pLen - padLen - 1 - t, application_data, 1); |
| 1182 | |
| 1183 | compress_rounds(ssl, get_rounds(pLen, padLen, t), dummy); |
| 1184 | |
| 1185 | if (constant_compare(verify, input + (pLen - padLen - 1 - t), t) != 0) |
| 1186 | return -1; |
| 1187 | |
| 1188 | return 0; |
| 1189 | } |
| 1190 | |
| 1191 | |
| 1192 | // Process handler for Data |
no test coverage detected