tree f8f99a782eb14f15a720f20ccf0c1cb5188bd773
parent 9265ff4ee6a843b7f1634facee2b087c8c7359fb
author Gilles Peskine <Gilles.Peskine@arm.com> 1538680710 +0200
committer Gilles Peskine <Gilles.Peskine@arm.com> 1538682269 +0200

Bleichenbacher fix: don't leak the plaintext length (step 2)

Replace memmove(to, to + offset, length) by a functionally equivalent
function that strives to make the same memory access patterns
regardless of the value of length. This fixes an information leak
through timing (especially timing of memory accesses via cache probes)
that leads to a Bleichenbacher-style attack on PKCS#1 v1.5 decryption
using the plaintext length as the observable.