Re: [PATCH] crypto: pkcs7_verify: use constant-time comparison for digest and signature verification

[David Gall <david.ccm.gall@googlemail.com>]

On Fri, Jul 10, 2026 at 01:56:51PM -0400, James Bottomley wrote:
> On Fri, 2026-07-10 at 19:30 +0200, David C.C.M. Gall wrote:
> > Replace memcmp() with crypto_memneq() for cryptographic digest and
> > signature comparisons to prevent timing side-channel attacks.
> > 
> > crypto/asymmetric_keys/pkcs7_verify.c: PKCS#7 message digest
> > comparison during signature verification passes argument pkcs7 and
> > attached signatures to pkcs7_digest via pkcs7_verify_one.
> > pkcs7_digest utilized memcmp which could leak valid prefix length for
> > attached signatures via timing side-channel.
> 
> Please explain how this information is usable by an attacker?  The
> assumption is the attacker sees the module (or whatever is signed) so
> the pkcs7 digest is inside the signature in plain text and the digest
> of the entity being compared should be computable by any attacker.
> 
> Regards,
> 
> James
> 
Looking into the usage of these methods a bit deeper, I agree with you
that an attacker does not gain any useful information. I double checked
and the method in question is also used as part of IMA modsig
collection during the measurement collection process, but there too the
method is not used to verify a signature, just to generate a hash, so
the comparison itself is never reached in that path.
                                                                                                                                                                                              
In that case, I'd actually drop this patch. The only affected paths
don't disclose anything useful to an attacker that can't already be
computed by just examining the content.

David