fix: services/util/SesameSecured: avoid timing attack on verifying MAC (

#818)
philips-software · Feb 7, 2025 · 51dca2d · 51dca2d
1 parent 784c7e5
commit 51dca2d
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/services/util/SesameSecured.cpp b/services/util/SesameSecured.cpp
@@ -125,7 +125,11 @@ namespace services
         std::array<uint8_t, blockSize> receivedMac;
         stream >> infra::MakeRange(receivedMac);
 
-        if (computedMac != receivedMac)
+        uint32_t numSame = 0;
+        for (auto i = 0; i != computedMac.size(); ++i)
+            numSame += computedMac[i] == receivedMac[i];
+
+        if (numSame != computedMac.size())
             return;
 
         IncreaseIv(receiveIv);