crypto: octeontx2 - use crypto_memneq() to check HMAC for cipher_null authenc

[PATCH] crypto: octeontx2 - use crypto_memneq() to check HMAC for cipher_null authenc

Posted by David C.C.M. Gall 1 month, 2 weeks ago

validate_hmac_cipher_null() compares the computed and received HMAC
with memcmp(), which short-circuits on the first differing byte and
leaks tag-match length via timing. Use crypto_memneq() instead.

Because for cipher_null the validated payload is un-encrypted, this
valid prefix leak allows for authenticated message forgery.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
---
 drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
index 8d9f394d6b50..3ccf17d031c6 100644
--- a/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
+++ b/drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c
@@ -11,6 +11,7 @@
 #include <crypto/xts.h>
 #include <crypto/gcm.h>
 #include <crypto/scatterwalk.h>
+#include <crypto/utils.h>
 #include <linux/sort.h>
 #include <linux/module.h>
 #include "otx2_cptvf.h"
@@ -90,9 +91,9 @@ static inline int validate_hmac_cipher_null(struct otx2_cpt_req_info *cpt_req)
 	req = container_of(cpt_req->areq, struct aead_request, base);
 	tfm = crypto_aead_reqtfm(req);
 	rctx = aead_request_ctx_dma(req);
-	if (memcmp(rctx->fctx.hmac.s.hmac_calc,
-		   rctx->fctx.hmac.s.hmac_recv,
-		   crypto_aead_authsize(tfm)) != 0)
+	if (crypto_memneq(rctx->fctx.hmac.s.hmac_calc,
+			  rctx->fctx.hmac.s.hmac_recv,
+			  crypto_aead_authsize(tfm)))
 		return -EBADMSG;
 
 	return 0;
-- 
2.43.0

Re: [PATCH] crypto: octeontx2 - use crypto_memneq() to check HMAC for cipher_null authenc

Posted by Herbert Xu 3 weeks, 3 days ago

On Sat, Aug 15, 2026 at 07:08:21PM +0200, David C.C.M. Gall wrote:
> validate_hmac_cipher_null() compares the computed and received HMAC
> with memcmp(), which short-circuits on the first differing byte and
> leaks tag-match length via timing. Use crypto_memneq() instead.
> 
> Because for cipher_null the validated payload is un-encrypted, this
> valid prefix leak allows for authenticated message forgery.
> 
> Assisted-by: gregkh_clanker_t1000
> Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
> ---
>  drivers/crypto/marvell/octeontx2/otx2_cptvf_algs.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt