authorgravatar for luke.champine@gmail.comlukechampine <luke.champine@gmail.com> 2019-11-05 11:51:16-05:00
committergravatar for luke.champine@gmail.comlukechampine <luke.champine@gmail.com> 2019-12-30 13:34:57-05:00
logae7bb4ecc03d063acc75058f74fcf43b61b5a358
treed41fc995d68d4e6bba5ff000f148b0c208aa03c5
parentfbe7d8c1cbb3fa6a6b080cad97067705cb7da1be
signature Commit is signed but in an unrecognized format.

chacha20poly1305: verify tag in constant time

1 files changed, 8 insertions(+), 2 deletions(-)

lib/std/crypto/chacha20.zig+8-2
......@@ -503,8 +503,14 @@ pub fn chacha20poly1305Open(dst: []u8, ciphertext: []const u8, data: []const u8,
503503 var computedTag: [16]u8 = undefined;
504504 mac.final(computedTag[0..]);
505505
506 // verify mac
507 if (!mem.eql(u8, polyTag, computedTag[0..])) {
506 // verify mac in constant time
507 // TODO: we can't currently guarantee that this will run in constant time.
508 // See https://github.com/ziglang/zig/issues/1776
509 var acc: u8 = 0;
510 for (computedTag) |_, i| {
511 acc |= (computedTag[i] ^ polyTag[i]);
512 }
513 if (acc != 0) {
508514 return false;
509515 }
510516