From: Eric Biggers <ebiggers@kernel.org>
To: Jarkko Sakkinen <jarkko@kernel.org>
Cc: James Bottomley <James.Bottomley@hansenpartnership.com>,
Mimi Zohar <zohar@linux.ibm.com>,
keyrings@vger.kernel.org, David Howells <dhowells@redhat.com>,
linux-integrity@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH 1/3] KEYS: trusted_tpm1: Compare HMAC values in constant time
Date: Sat, 9 Aug 2025 10:21:27 -0700 [thread overview]
Message-ID: <20250809172127.GA3339@quark> (raw)
In-Reply-To: <aJck_YVdFqZoRk--@kernel.org>
On Sat, Aug 09, 2025 at 01:37:49PM +0300, Jarkko Sakkinen wrote:
> On Tue, Aug 05, 2025 at 10:32:27AM -0700, Eric Biggers wrote:
> > On Tue, Aug 05, 2025 at 04:44:27PM +0300, Jarkko Sakkinen wrote:
> > > On Thu, Jul 31, 2025 at 02:23:52PM -0700, Eric Biggers wrote:
> > > > To prevent timing attacks, HMAC value comparison needs to be constant
> > > > time. Replace the memcmp() with the correct function, crypto_memneq().
> > > >
> > > > Fixes: d00a1c72f7f4 ("keys: add new trusted key-type")
> > > > Cc: stable@vger.kernel.org
> > > > Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> > >
> > > Was crypto_memneq() available at the time?
> >
> > No. The Fixes commit is still correct, though, as it's the commit that
> > introduced the memcmp(). Technically it was still a bug at that time,
> > even if there wasn't a helper function available yet.
>
> Add a remark to the commit message.
I don't know what the point is (both commits are over a decade old), but
sure I did that in v2.
- Eric
next prev parent reply other threads:[~2025-08-09 17:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-31 21:23 [PATCH 0/3] KEYS: trusted_tpm1: HMAC fix and cleanup Eric Biggers
2025-07-31 21:23 ` [PATCH 1/3] KEYS: trusted_tpm1: Compare HMAC values in constant time Eric Biggers
2025-08-05 13:44 ` Jarkko Sakkinen
2025-08-05 17:32 ` Eric Biggers
2025-08-09 10:37 ` Jarkko Sakkinen
2025-08-09 17:21 ` Eric Biggers [this message]
2025-07-31 21:23 ` [PATCH 2/3] KEYS: trusted_tpm1: Use SHA-1 library instead of crypto_shash Eric Biggers
2025-08-05 13:45 ` Jarkko Sakkinen
2025-07-31 21:23 ` [PATCH 3/3] KEYS: trusted_tpm1: Move private functionality out of public header Eric Biggers
2025-08-05 13:48 ` Jarkko Sakkinen
2025-08-05 17:33 ` Eric Biggers
2025-08-09 10:38 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250809172127.GA3339@quark \
--to=ebiggers@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=dhowells@redhat.com \
--cc=jarkko@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.