Manuel Pégourié-Gonnard aeeaaf271c Add counter-measure to cache-based Lucky 13 ...

The basis for the Lucky 13 family of attacks is for an attacker to be able to
distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding.
Since our code sets padlen = 0 for invalid padding, the length of the input to
the HMAC function, and the location where we read the MAC, give information
about that.

A local attacker could gain information about that by observing via a
cache attack whether the bytes at the end of the record (at the location of
would-be padding) have been read during MAC verification (computation +
comparison).

Let's make sure they're always read.

2018-07-12 10:18:37 +02:00

134 KiB

Raw Blame History

View Raw