| commit | 1e91fd41699653582d5cc386ad32885f1c844685 | [log] [tgz] |
|---|---|---|
| author | Matthew Riley <mattdr@google.com> | Thu Jul 14 15:43:00 2016 -0700 |
| committer | Matthew Riley <mattdr@google.com> | Fri Jul 15 11:26:08 2016 -0700 |
| tree | a2a2f675d7c9f47ad4c82e417d9bf63980ef5010 | |
| parent | f97b18d7686b6e9a750e55f93dc4bc1153ddee52 [diff] |
Replace octet_string_is_eq with a constant-time implementation This function is used to check authentication tags in srtp_unprotect. The current early-exit implementation might offer a timing sidechannel, enabling attackers to brute-force a correct HMAC to a forged message. Such attacks shouldn't be possible if replay protection is enabled, but this is nonetheless good defense in depth. The implementation is similar to CRYPTO_memcmp from OpenSSL/BoringSSL.