diff options
| author | Ben Laurie <ben@links.org> | 2013-01-28 17:31:49 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2013-02-06 13:56:12 +0000 |
| commit | fb0a59cc58e69203b1269d5f1c355f4944a8b350 (patch) | |
| tree | 63b6f5511fbe638585c834b9bf8416254bac2056 /ssl/ssl_algs.c | |
| parent | f5cd3561ba9363e6bcc58fcb6b1e94930f81967d (diff) | |
Make CBC decoding constant time.
This patch makes the decoding of SSLv3 and TLS CBC records constant
time. Without this, a timing side-channel can be used to build a padding
oracle and mount Vaudenay's attack.
This patch also disables the stitched AESNI+SHA mode pending a similar
fix to that code.
In order to be easy to backport, this change is implemented in ssl/,
rather than as a generic AEAD mode. In the future this should be changed
around so that HMAC isn't in ssl/, but crypto/ as FIPS expects.
(cherry picked from commit e130841bccfc0bb9da254dc84e23bc6a1c78a64e)
Diffstat (limited to 'ssl/ssl_algs.c')
| -rw-r--r-- | ssl/ssl_algs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ssl/ssl_algs.c b/ssl/ssl_algs.c index d443143c59..41ccbaac30 100644 --- a/ssl/ssl_algs.c +++ b/ssl/ssl_algs.c @@ -90,11 +90,14 @@ int SSL_library_init(void) EVP_add_cipher(EVP_aes_256_cbc()); EVP_add_cipher(EVP_aes_128_gcm()); EVP_add_cipher(EVP_aes_256_gcm()); +#if 0 /* Disabled because of timing side-channel leaks. */ #if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1) EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1()); EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1()); #endif #endif + +#endif #ifndef OPENSSL_NO_CAMELLIA EVP_add_cipher(EVP_camellia_128_cbc()); EVP_add_cipher(EVP_camellia_256_cbc()); |