yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'mbedtls-1.3' into development

Browse source 
* mbedtls-1.3:
  Add countermeasure against cache-based lucky 13

Conflicts:
	library/ssl_tls.c
This commit is contained in:
Manuel Pégourié-Gonnard 2015-04-29 02:13:42 +02:00
commit 8a81e84638
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -90,6 +90,8 @@ Security
* With authmode set to SSL_VERIFY_OPTIONAL, verification of keyUsage and * With authmode set to SSL_VERIFY_OPTIONAL, verification of keyUsage and
extendedKeyUsage on the leaf certificate was lost (results not accessible extendedKeyUsage on the leaf certificate was lost (results not accessible
via ssl_get_verify_results()). via ssl_get_verify_results()).
* Add countermeasure against "Lucky 13 strikes back" cache-based attack,
https://dl.acm.org/citation.cfm?id=2714625
Features Features
* Add x509_crt_verify_info() to display certificate verification results. * Add x509_crt_verify_info() to display certificate verification results.

3
library/ssl_tls.c
View file

@ -1943,7 +1943,8 @@ static int ssl_decrypt_buf( mbedtls_ssl_context *ssl )
ssl->in_msglen ); ssl->in_msglen );
mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec, mbedtls_md_hmac_finish( &ssl->transform_in->md_ctx_dec,
ssl->in_msg + ssl->in_msglen ); ssl->in_msg + ssl->in_msglen );
for( j = 0; j < extra_run; j++ ) /* Call md_process at least once due to cache attacks */
for( j = 0; j < extra_run + 1; j++ )
mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg ); mbedtls_md_process( &ssl->transform_in->md_ctx_dec, ssl->in_msg );
mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec ); mbedtls_md_hmac_reset( &ssl->transform_in->md_ctx_dec );