1775359 - NSS_SecureMemcmp should reveal less in the non-equality case

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P5)

Description

[John Schanck [:jschanck] (out of office Aug 11-18)]

The NSS_SecureMemcmp function takes two arrays of equal length and outputs 0 if the arrays are bytewise equal and non-zero otherwise. The current implementation returns the OR of the bytewise XOR:

unsigned char r = 0;
for (i = 0; i < n; ++i)
  r |= a[i] ^ b[i];
return r;

This implementation reveals more about the inputs than is strictly necessary. E.g. it reveals whether or not a and b differ in bit 3 for some i. A more defensive implementation would output a fixed value, e.g. 1, in the case of non-equality.

A simple fix is to change r to an int and return 1 & (-r >> 8).

Comment 1

[John Schanck [:jschanck] (out of office Aug 11-18)]

Attachment: Bug 1775359 - make NSS_SecureMemcmp 0/1 valued. r=#nss-reviewers

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:jschanck, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 3

[John Schanck [:jschanck] (out of office Aug 11-18)]

https://hg.mozilla.org/projects/nss/rev/07727985696a30d3317f626c3d93ccb3302a611b