Timing fix mitigation for FIPS mode.

We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to HMAC_Update to hash additonal blocks
to cover any timing differences caused by removal of padding.

diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index a29ff66b79d0fecb523d019755b988d0889453af..1819f6cf013e0e5f5504660d7cc7aa0d4769b95f 100644 (file)
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -367,6 +367,10 @@ static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
  * which ssl3_cbc_digest_record supports. */
 char ssl3_cbc_record_digest_supported(const EVP_MD *digest)
        {
+#ifdef OPENSSL_FIPS
+       if (FIPS_mode())
+               return 0;
+#endif
        switch (digest->type)
                {
                case NID_md5:
@@ -693,3 +697,50 @@ void ssl3_cbc_digest_record(
                *md_out_size = md_out_size_u;
        EVP_MD_CTX_cleanup(&md_ctx);
        }
+
+#ifdef OPENSSL_FIPS
+
+/* Due to the need to use EVP in FIPS mode we can't reimplement digests but
+ * we can ensure the number of blocks processed is equal for all cases
+ * by digesting additional data.
+ */
+
+void tls_fips_digest_extra(
+       const EVP_CIPHER_CTX *cipher_ctx, const EVP_MD *hash, HMAC_CTX *hctx,
+       const unsigned char *data, size_t data_len, size_t orig_len)
+       {
+       size_t block_size, digest_pad, blocks_data, blocks_orig;
+       if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
+               return;
+       block_size = EVP_MD_block_size(hash);
+       /* We are in FIPS mode if we get this far so we know we have only SHA*
+        * digests and TLS to deal with.
+        * Minimum digest padding length is 17 for SHA384/SHA512 and 9
+        * otherwise.
+        * Additional header is 13 bytes. To get the number of digest blocks
+        * processed round up the amount of data plus padding to the nearest
+        * block length. Block length is 128 for SHA384/SHA512 and 64 otherwise.
+        * So we have:
+        * blocks = (payload_len + digest_pad + 13 + block_size - 1)/block_size
+        * equivalently:
+        * blocks = (payload_len + digest_pad + 12)/block_size + 1
+        * HMAC adds a constant overhead.
+        * We're ultimately only interested in differences so this becomes
+        * blocks = (payload_len + 29)/128
+        * for SHA384/SHA512 and
+        * blocks = (payload_len + 21)/64
+        * otherwise.
+        */
+       digest_pad = block_size == 64 ? 21 : 29;
+       blocks_orig = (orig_len + digest_pad)/block_size;
+       blocks_data = (data_len + digest_pad)/block_size;
+       /* MAC enough blocks to make up the difference between the original
+        * and actual lengths plus one extra block to ensure this is never a
+        * no op. The "data" pointer should always have enough space to
+        * perform this operation as it is large enough for a maximum
+        * length TLS buffer. 
+        */
+       HMAC_Update(hctx, data,
+                               (blocks_orig - blocks_data + 1) * block_size);
+       }
+#endif

diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 2f923a5e65fb6566b676ca5fdcec98fc04170f39..57e92323fcc5e8299fdb96b91abe7bccec4e5d88 100644 (file)
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -1037,5 +1037,8 @@ void ssl3_cbc_digest_record(
        unsigned mac_secret_length,
        char is_sslv3);
 
+void tls_fips_digest_extra(
+       const EVP_CIPHER_CTX *cipher_ctx, const EVP_MD *hash, HMAC_CTX *hctx,
+       const unsigned char *data, size_t data_len, size_t orig_len);
 
 #endif

diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index d621293a74b24e7087c11dd6924d21d272c357e3..e75a66ba9d5a8410e7c0bbc24c1a4a7047bd0760 100644 (file)
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -758,6 +758,14 @@ int tls1_mac(SSL *ssl, unsigned char *md, int send)
                HMAC_Update(&hmac,rec->input,rec->length);
                HMAC_Final(&hmac,md,&mds);
                md_size = mds;
+#ifdef OPENSSL_FIPS
+               if (!send && FIPS_mode())
+                       tls_fips_digest_extra(
+                                       ssl->enc_read_ctx,
+                                       hash,
+                                       &hmac, rec->input,
+                                       rec->length, rec->orig_len);
+#endif
                }
                
        HMAC_CTX_cleanup(&hmac);