[PATCH] crypto: pkcs7 - Use constant-time message digest comparison

[PATCH] crypto: pkcs7 - Use constant-time message digest comparison

[Jiangshan Yi]

The message digest comparison in pkcs7_verify() uses memcmp(), whose
execution time depends on the position of the first mismatched byte.
This creates a timing side-channel that could allow an attacker to
forge PKCS#7 signatures byte by byte.

Replace memcmp() with crypto_memneq() to perform a constant-time
comparison, consistent with the rest of the crypto subsystem
(gcm, ccm, chacha20poly1305, rsassa-pkcs1, krb5, verify_pefile, etc.).
Add an explicit <crypto/utils.h> include since this file did not
previously pull in the crypto_memneq() declaration.

Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 crypto/asymmetric_keys/pkcs7_verify.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c
index 474e2c1ae21b..8c619b252ca5 100644
--- a/crypto/asymmetric_keys/pkcs7_verify.c
+++ b/crypto/asymmetric_keys/pkcs7_verify.c
@@ -14,6 +14,7 @@
 #include <crypto/hash.h>
 #include <crypto/hash_info.h>
 #include <crypto/public_key.h>
+#include <crypto/utils.h>
 #include "pkcs7_parser.h"
 
 /*
@@ -93,8 +94,8 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7,
 			goto error;
 		}
 
-		if (memcmp(sig->m, sinfo->msgdigest,
-			   sinfo->msgdigest_len) != 0) {
+		if (crypto_memneq(sig->m, sinfo->msgdigest,
+				  sinfo->msgdigest_len)) {
 			pr_warn("Sig %u: Message digest doesn't match\n",
 				sinfo->index);
 			ret = -EKEYREJECTED;
-- 
2.25.1

Re: [PATCH] crypto: pkcs7 - Use constant-time message digest comparison

[Lukas Wunner]

On Mon, Jul 20, 2026 at 11:23:16AM +0800, Jiangshan Yi wrote:
> +++ b/crypto/asymmetric_keys/pkcs7_verify.c
> @@ -93,8 +94,8 @@ static int pkcs7_digest(struct pkcs7_message *pkcs7,
>  			goto error;
>  		}
>  
> -		if (memcmp(sig->m, sinfo->msgdigest,
> -			   sinfo->msgdigest_len) != 0) {
> +		if (crypto_memneq(sig->m, sinfo->msgdigest,
> +				  sinfo->msgdigest_len)) {
>  			pr_warn("Sig %u: Message digest doesn't match\n",
>  				sinfo->index);
>  			ret = -EKEYREJECTED;

The exact same patch was previously submitted by someone else
and rejected:

https://lore.kernel.org/all/alEsSl8i1_FpoU0f@fudgebox/T/#u