[PATCH] crypto: pkcs7_verify: use constant-time comparison for digest and signature verification

[PATCH] crypto: pkcs7_verify: use constant-time comparison for digest and signature verification

[David C.C.M. Gall]

Replace memcmp() with crypto_memneq() for cryptographic digest and
signature comparisons to prevent timing side-channel attacks.

crypto/asymmetric_keys/pkcs7_verify.c: PKCS#7 message digest comparison
during signature verification passes argument pkcs7 and attached
signatures to pkcs7_digest via pkcs7_verify_one. pkcs7_digest utilized
memcmp which could leak valid prefix length for attached signatures via
timing side-channel.

Assisted-by: gregkh_clanker_t1000
Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
---
 crypto/asymmetric_keys/pkcs7_verify.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 474e2c1ae21b..28953e53177b 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -13,6 +13,7 @@
 #include <linux/asn1.h>
 #include <crypto/hash.h>
 #include <crypto/hash_info.h>
+#include <crypto/utils.h>
 #include <crypto/public_key.h>
 #include "pkcs7_parser.h"
 
@@ -93,8 +94,8 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7,
 			goto error;
 		}
 
-		if (memcmp(sig->m, sinfo->msgdigest,
-			   sinfo->msgdigest_len) != 0) {
+		if (crypto_memneq(sig->m, sinfo->msgdigest,
+				  sinfo->msgdigest_len)) {
 			pr_warn("Sig %u: Message digest doesn't match\n",
 				sinfo->index);
 			ret = -EKEYREJECTED;
-- 
2.43.0

Re: [PATCH] crypto: pkcs7_verify: use constant-time comparison for digest and signature verification

[James Bottomley]

On Fri, 2026-07-10 at 19:30 +0200, David C.C.M. Gall wrote:
> Replace memcmp() with crypto_memneq() for cryptographic digest and
> signature comparisons to prevent timing side-channel attacks.
> 
> crypto/asymmetric_keys/pkcs7_verify.c: PKCS#7 message digest
> comparison during signature verification passes argument pkcs7 and
> attached signatures to pkcs7_digest via pkcs7_verify_one.
> pkcs7_digest utilized memcmp which could leak valid prefix length for
> attached signatures via timing side-channel.

Please explain how this information is usable by an attacker?  The
assumption is the attacker sees the module (or whatever is signed) so
the pkcs7 digest is inside the signature in plain text and the digest
of the entity being compared should be computable by any attacker.

Regards,

James