Re: [PATCH] crypto: rsassa-pkcs1: use constant-time comparison for digest and signature verification

[David Gall <david.ccm.gall@googlemail.com>]

On Sat, Jul 11, 2026 at 09:00:23AM +0100, Ignat Korchagin wrote:
> On Sat, Jul 11, 2026 at 6:19 AM Greg KH <gregkh@linuxfoundation.org> wrote:
> >
> > On Fri, Jul 10, 2026 at 05:37:18PM -0400, Eric Biggers wrote:
> > > On Fri, Jul 10, 2026 at 07:29:33PM +0200, David C.C.M. Gall wrote:
> > > > Replace memcmp() with crypto_memneq() for cryptographic digest and
> > > > signature comparisons to prevent timing side-channel attacks.
> > > >
> > > > crypto/rsassa-pkcs1.c: RSA signature digest verification used memcmp
> > > > which can leak valid prefix length via timing analysis, user data
> > > > could reach the leaky comparison via the digest argument to verify.
> > > >
> > > > Assisted-by: gregkh_clanker_t1000
> > > > Signed-off-by: David C.C.M. Gall <david.ccm.gall@googlemail.com>
> > >
> > > While we should use crypto_memneq() on MACs, auth tags, and other secret
> > > data, I don't think we should let it creep into domains where it is
> > > clearly not needed, like public key signature verification.
> >
> > But isn't this user-controlled data and so a user could use it to figure
> > out the key?
> 
> This is signature verification with a public key. So the user knows
> the key already.
> 
> > thanks,
> >
> > greg k-h
> >
> 
> Ignat
Nevermind, my reasoning on how this method is used was faulty. The
crypto_memneq call does not protect against digest forgery, the
public key is already available to anyone attempting verification,
so an attacker can compute the padding/digest offline without needing
the kernel's comparison at all, timing or otherwise.

That said, this function already uses crypto_memneq for the hash-prefix
check a few lines above. I'd argue for consistency it's worth using it
for the digest comparison too.

David