tbbr: Use constant-time bcmp() to compare hashes

To avoid timing side-channel attacks, it is needed to use a constant
time memory comparison function when comparing hashes. The affected
code only cheks for equality so it isn't needed to use any variant of
memcmp(), bcmp() is enough.

Also, timingsafe_bcmp() is as fast as memcmp() when the two compared
regions are equal, so this change incurrs no performance hit in said
case. In case they are unequal, the boot sequence wouldn't continue as
normal, so performance is not an issue.

Change-Id: I1c7c70ddfa4438e6031c8814411fef79fd3bb4df
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

diff --git a/drivers/auth/mbedtls/mbedtls_crypto.c b/drivers/auth/mbedtls/mbedtls_crypto.c
index 1a96e8f8d0cb54f72ceb63bc311402867a5269d1..11d3ede45abe0211d7279c3079fe9335edb55a6f 100644 (file)
--- a/drivers/auth/mbedtls/mbedtls_crypto.c
+++ b/drivers/auth/mbedtls/mbedtls_crypto.c
@@ -217,7 +217,7 @@ static int verify_hash(void *data_ptr, unsigned int data_len,
        }
 
        /* Compare values */
-       rc = memcmp(data_hash, hash, mbedtls_md_get_size(md_info));
+       rc = timingsafe_bcmp(data_hash, hash, mbedtls_md_get_size(md_info));
        if (rc != 0) {
                return CRYPTO_ERR_HASH;
        }

diff --git a/drivers/auth/mbedtls/mbedtls_x509_parser.c b/drivers/auth/mbedtls/mbedtls_x509_parser.c
index 73da9d1e7c4d8a264073a8305e12a37e97f410de..f9485de3d205d305a3bc01805ea4a672103c545b 100644 (file)
--- a/drivers/auth/mbedtls/mbedtls_x509_parser.c
+++ b/drivers/auth/mbedtls/mbedtls_x509_parser.c
@@ -392,7 +392,7 @@ static int cert_parse(void *img, unsigned int img_len)
        if (sig_alg1.len != sig_alg2.len) {
                return IMG_PARSER_ERR_FORMAT;
        }
-       if (0 != memcmp(sig_alg1.p, sig_alg2.p, sig_alg1.len)) {
+       if (0 != timingsafe_bcmp(sig_alg1.p, sig_alg2.p, sig_alg1.len)) {
                return IMG_PARSER_ERR_FORMAT;
        }
        memcpy(&sig_alg, &sig_alg1, sizeof(sig_alg));