From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 3 Mar 2003 16:08:21 +0000 (+0000)
Subject: Added protection against the new TLS 1.0 record layer timing attack.
X-Git-Tag: gnutls_0_8_3~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2fbcfbc3c3039b311c3c80650da5e00a9e9b5952;p=thirdparty%2Fgnutls.git

Added protection against the new TLS 1.0 record layer timing attack.
---

diff --git a/NEWS b/NEWS
index 6fc313839f..4b6319ead0 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,10 @@ Version 0.9.0
   can now hold only one temporary parameter of a kind.
 - Added a new Certificate, CRL, Private key and PKCS7 structures handling 
   API, defined in gnutls/x509.h
+- Added gnutls_certificate_set_verify_flags() function to allow setting the 
+  verification flags in the credentials structure. They will be used in the
+  *verify_peers functions.
+- Added protection against the new TLS 1.0 record layer timing attack.
 - Added support for Certificate revocation lists. Functions defined
   in gnutls/x509.h
 - The only functions were removed are:
diff --git a/lib/gnutls_cipher.c b/lib/gnutls_cipher.c
index 69787242a6..c31ac04da5 100644
--- a/lib/gnutls_cipher.c
+++ b/lib/gnutls_cipher.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ *  Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
  *
  *  This file is part of GNUTLS.
  *
@@ -336,7 +336,7 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
 	uint16 length;
 	GNUTLS_MAC_HANDLE td;
 	uint16 blocksize;
-	int ret, i;
+	int ret, i, pad_failed = 0;
 	uint8 major, minor;
 	gnutls_protocol_version ver;
 	int hash_size = _gnutls_mac_get_digest_size(session->security_parameters.read_mac_algorithm);
@@ -398,7 +398,10 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
 		if (pad >
 		    ciphertext.size - hash_size) {
 			gnutls_assert();
-			return GNUTLS_E_DECRYPTION_FAILED;
+			/* We do not fail here. We check below for the
+			 * the pad_failed. If zero means success.
+			 */
+			pad_failed = GNUTLS_E_DECRYPTION_FAILED;
 		}
 		
 		/* Check the pading bytes (TLS 1.0 only)
@@ -407,7 +410,7 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
 		for (i=2;i<pad;i++) {
 			if (ciphertext.data[ciphertext.size-i] != ciphertext.data[ciphertext.size - 1]) {
 				gnutls_assert();
-				return GNUTLS_E_DECRYPTION_FAILED;
+				pad_failed = GNUTLS_E_DECRYPTION_FAILED;
 			}
 		}
 		
@@ -456,6 +459,11 @@ int _gnutls_ciphertext2compressed(gnutls_session session,
 		gnutls_assert();
 		return GNUTLS_E_DECRYPTION_FAILED;
 	}
+	
+	/* This one was introduced to avoid a timing attack against the TLS
+	 * 1.0 protocol.
+	 */
+	if (pad_failed != 0) return pad_failed;
 
 	return length;
 }
diff --git a/lib/gnutls_cipher_int.c b/lib/gnutls_cipher_int.c
index 49dc86cfb0..7ca96386a2 100644
--- a/lib/gnutls_cipher_int.c
+++ b/lib/gnutls_cipher_int.c
@@ -1,7 +1,7 @@
 /*
- * Copyright (C) 2000 Nikos Mavroyanopoulos
+ *  Copyright (C) 2000 Nikos Mavroyanopoulos
  *
- * This file is part of GNUTLS.
+ *  This file is part of GNUTLS.
  *
  *  The GNUTLS library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public