Commit 1e3b5603 authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Greg Kroah-Hartman

Bluetooth: use constant time memory comparison for secret values

commit 329d8230 upstream.

This file is filled with complex cryptography. Thus, the comparisons of
MACs and secret keys and curve points and so forth should not add timing
attacks, which could either result in a direct forgery, or, given the
complexity, some other type of attack.
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3762d7ed
...@@ -23,6 +23,7 @@ ...@@ -23,6 +23,7 @@
#include <linux/debugfs.h> #include <linux/debugfs.h>
#include <linux/crypto.h> #include <linux/crypto.h>
#include <linux/scatterlist.h> #include <linux/scatterlist.h>
#include <crypto/algapi.h>
#include <crypto/b128ops.h> #include <crypto/b128ops.h>
#include <net/bluetooth/bluetooth.h> #include <net/bluetooth/bluetooth.h>
...@@ -524,7 +525,7 @@ bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16], ...@@ -524,7 +525,7 @@ bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16],
if (err) if (err)
return false; return false;
return !memcmp(bdaddr->b, hash, 3); return !crypto_memneq(bdaddr->b, hash, 3);
} }
int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa) int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa)
...@@ -577,7 +578,7 @@ int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16]) ...@@ -577,7 +578,7 @@ int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16])
/* This is unlikely, but we need to check that /* This is unlikely, but we need to check that
* we didn't accidentially generate a debug key. * we didn't accidentially generate a debug key.
*/ */
if (memcmp(smp->local_sk, debug_sk, 32)) if (crypto_memneq(smp->local_sk, debug_sk, 32))
break; break;
} }
smp->debug_key = false; smp->debug_key = false;
...@@ -991,7 +992,7 @@ static u8 smp_random(struct smp_chan *smp) ...@@ -991,7 +992,7 @@ static u8 smp_random(struct smp_chan *smp)
if (ret) if (ret)
return SMP_UNSPECIFIED; return SMP_UNSPECIFIED;
if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) { if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) {
BT_ERR("Pairing failed (confirmation values mismatch)"); BT_ERR("Pairing failed (confirmation values mismatch)");
return SMP_CONFIRM_FAILED; return SMP_CONFIRM_FAILED;
} }
...@@ -1491,7 +1492,7 @@ static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op) ...@@ -1491,7 +1492,7 @@ static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op)
smp->rrnd, r, cfm)) smp->rrnd, r, cfm))
return SMP_UNSPECIFIED; return SMP_UNSPECIFIED;
if (memcmp(smp->pcnf, cfm, 16)) if (crypto_memneq(smp->pcnf, cfm, 16))
return SMP_CONFIRM_FAILED; return SMP_CONFIRM_FAILED;
smp->passkey_round++; smp->passkey_round++;
...@@ -1875,7 +1876,7 @@ static u8 sc_send_public_key(struct smp_chan *smp) ...@@ -1875,7 +1876,7 @@ static u8 sc_send_public_key(struct smp_chan *smp)
/* This is unlikely, but we need to check that /* This is unlikely, but we need to check that
* we didn't accidentially generate a debug key. * we didn't accidentially generate a debug key.
*/ */
if (memcmp(smp->local_sk, debug_sk, 32)) if (crypto_memneq(smp->local_sk, debug_sk, 32))
break; break;
} }
} }
...@@ -2140,7 +2141,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) ...@@ -2140,7 +2141,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
if (err) if (err)
return SMP_UNSPECIFIED; return SMP_UNSPECIFIED;
if (memcmp(smp->pcnf, cfm, 16)) if (crypto_memneq(smp->pcnf, cfm, 16))
return SMP_CONFIRM_FAILED; return SMP_CONFIRM_FAILED;
} else { } else {
smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
...@@ -2621,7 +2622,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) ...@@ -2621,7 +2622,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
if (err) if (err)
return SMP_UNSPECIFIED; return SMP_UNSPECIFIED;
if (memcmp(cfm.confirm_val, smp->pcnf, 16)) if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16))
return SMP_CONFIRM_FAILED; return SMP_CONFIRM_FAILED;
} }
...@@ -2654,7 +2655,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) ...@@ -2654,7 +2655,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb)
else else
hcon->pending_sec_level = BT_SECURITY_FIPS; hcon->pending_sec_level = BT_SECURITY_FIPS;
if (!memcmp(debug_pk, smp->remote_pk, 64)) if (!crypto_memneq(debug_pk, smp->remote_pk, 64))
set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags);
if (smp->method == DSP_PASSKEY) { if (smp->method == DSP_PASSKEY) {
...@@ -2753,7 +2754,7 @@ static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb) ...@@ -2753,7 +2754,7 @@ static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb)
if (err) if (err)
return SMP_UNSPECIFIED; return SMP_UNSPECIFIED;
if (memcmp(check->e, e, 16)) if (crypto_memneq(check->e, e, 16))
return SMP_DHKEY_CHECK_FAILED; return SMP_DHKEY_CHECK_FAILED;
if (!hcon->out) { if (!hcon->out) {
...@@ -3463,7 +3464,7 @@ static int __init test_ah(struct crypto_blkcipher *tfm_aes) ...@@ -3463,7 +3464,7 @@ static int __init test_ah(struct crypto_blkcipher *tfm_aes)
if (err) if (err)
return err; return err;
if (memcmp(res, exp, 3)) if (crypto_memneq(res, exp, 3))
return -EINVAL; return -EINVAL;
return 0; return 0;
...@@ -3493,7 +3494,7 @@ static int __init test_c1(struct crypto_blkcipher *tfm_aes) ...@@ -3493,7 +3494,7 @@ static int __init test_c1(struct crypto_blkcipher *tfm_aes)
if (err) if (err)
return err; return err;
if (memcmp(res, exp, 16)) if (crypto_memneq(res, exp, 16))
return -EINVAL; return -EINVAL;
return 0; return 0;
...@@ -3518,7 +3519,7 @@ static int __init test_s1(struct crypto_blkcipher *tfm_aes) ...@@ -3518,7 +3519,7 @@ static int __init test_s1(struct crypto_blkcipher *tfm_aes)
if (err) if (err)
return err; return err;
if (memcmp(res, exp, 16)) if (crypto_memneq(res, exp, 16))
return -EINVAL; return -EINVAL;
return 0; return 0;
...@@ -3550,7 +3551,7 @@ static int __init test_f4(struct crypto_hash *tfm_cmac) ...@@ -3550,7 +3551,7 @@ static int __init test_f4(struct crypto_hash *tfm_cmac)
if (err) if (err)
return err; return err;
if (memcmp(res, exp, 16)) if (crypto_memneq(res, exp, 16))
return -EINVAL; return -EINVAL;
return 0; return 0;
...@@ -3584,10 +3585,10 @@ static int __init test_f5(struct crypto_hash *tfm_cmac) ...@@ -3584,10 +3585,10 @@ static int __init test_f5(struct crypto_hash *tfm_cmac)
if (err) if (err)
return err; return err;
if (memcmp(mackey, exp_mackey, 16)) if (crypto_memneq(mackey, exp_mackey, 16))
return -EINVAL; return -EINVAL;
if (memcmp(ltk, exp_ltk, 16)) if (crypto_memneq(ltk, exp_ltk, 16))
return -EINVAL; return -EINVAL;
return 0; return 0;
...@@ -3620,7 +3621,7 @@ static int __init test_f6(struct crypto_hash *tfm_cmac) ...@@ -3620,7 +3621,7 @@ static int __init test_f6(struct crypto_hash *tfm_cmac)
if (err) if (err)
return err; return err;
if (memcmp(res, exp, 16)) if (crypto_memneq(res, exp, 16))
return -EINVAL; return -EINVAL;
return 0; return 0;
...@@ -3674,7 +3675,7 @@ static int __init test_h6(struct crypto_hash *tfm_cmac) ...@@ -3674,7 +3675,7 @@ static int __init test_h6(struct crypto_hash *tfm_cmac)
if (err) if (err)
return err; return err;
if (memcmp(res, exp, 16)) if (crypto_memneq(res, exp, 16))
return -EINVAL; return -EINVAL;
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment