F-7260 - Make PKCS#1 v1.5 unpadding branch-free

Author: aidangarske

src/tpm2_asn.c

@@ -366,31 +366,65 @@ int TPM2_ASN_DecodeRsaPubKey(uint8_t* input, int inputSz,
     return rc;
 }
 
-int TPM2_ASN_RsaUnpadPkcsv15(uint8_t** pSig, int* sigSz)
+/* Width-independent sign bit position of unsigned int */
+#define TPM2_ASN_CT_SHIFT ((unsigned int)(sizeof(unsigned int) * 8u - 1u))
+
+/* 1 when v is zero, without a data-dependent branch */
+static int TPM2_ASN_CtIsZero(unsigned int v)
 {
-    int rc = -1;
-    uint8_t* sig = *pSig;
-    int idx = 0;
+    return (int)((((v | (0u - v)) >> TPM2_ASN_CT_SHIFT) & 1u) ^ 1u);
+}
 
-    if (*sigSz < 3)
-        return rc;
+/* 1 when a is less than b, for values well below the unsigned range */
+static int TPM2_ASN_CtLt(unsigned int a, unsigned int b)
+{
+    return (int)(((a - b) >> TPM2_ASN_CT_SHIFT) & 1u);
+}
 
-    if (sig[idx++] == 0x00 && sig[idx++] == 0x01) {
-        while (idx < *sigSz) {
-            if (sig[idx] != 0xFF)
-                break;
-            idx++;
-        }
-        /* Require the null separator to be in bounds (avoids a 1-byte
-         * over-read) and at least 8 padding bytes per PKCS#1 v1.5 Sec.9.2
-         * (also rejects the all-0xFF Bleichenbacher variant). */
-        if (idx < *sigSz && (idx - 2) >= 8 && sig[idx++] == 0x00) {
-            rc = 0;
-            *pSig = &sig[idx];
-            *sigSz -= idx;
-        }
-    }
-    return rc;
+int TPM2_ASN_RsaUnpadPkcsv15(uint8_t** pSig, int* sigSz)
+{
+    uint8_t* sig = *pSig;
+    int len = *sigSz;
+    int i;
+    int isFF, notYet, isSep;
+    int sepFound = 0;
+    int sepIdx = 0;
+    int dataIdx;
+    volatile int bad = 0;
+
+    if (len < 3)
+        return -1;
+
+    /* Block type 1: 0x00 0x01 FF..FF 0x00 data. Every check below folds
+     * into an accumulator so no branch depends on the buffer contents. */
+    bad |= sig[0];
+    bad |= (sig[1] ^ 0x01);
+
+    /* Locate the first byte at or after index 2 that is not 0xFF, scanning
+     * the whole buffer so the padding length is not revealed by timing. */
+    for (i = 2; i < len; i++) {
+        /* 1 when sig[i] is 0xFF, without branching on the byte value */
+        isFF = TPM2_ASN_CtIsZero((unsigned int)(sig[i] ^ 0xFF));
+        notYet = 1 - sepFound;
+        isSep = notYet & (1 - isFF);
+        sepIdx += isSep * i;
+        sepFound |= isSep;
+    }
+
+    /* A separator must exist, must be 0x00, and must follow at least 8
+     * padding bytes per PKCS#1 v1.5 Sec.9.2 (this also rejects the
+     * all-0xFF Bleichenbacher variant). */
+    bad |= (1 - sepFound);
+    bad |= sig[sepIdx];
+    bad |= TPM2_ASN_CtLt((unsigned int)sepIdx, 10u);
+
+    if (bad != 0)
+        return -1;
+
+    dataIdx = sepIdx + 1;
+    *pSig = &sig[dataIdx];
+    *sigSz -= dataIdx;
+    return 0;
 }
 
 #endif /* !WOLFTPM2_NO_ASN */

tests/unit_tests.c

@@ -4947,6 +4947,79 @@ static void test_TPM2_ASN_DecodeX509Cert_Errors(void)
 #endif
 }
 
+static void test_TPM2_ASN_RsaUnpadPkcsv15(void)
+{
+#if !defined(WOLFTPM2_NO_WRAPPER) && !defined(WOLFTPM2_NO_ASN)
+    byte blk[64];
+    byte* p;
+    int sz;
+    int i;
+
+    /* Well formed: 00 01 FF*8 00 then 2 data bytes */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x01; blk[10] = 0x00;
+    blk[11] = 0xAA; blk[12] = 0xBB;
+    p = blk; sz = 13;
+    AssertIntEQ(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+    AssertIntEQ(sz, 2);
+    AssertIntEQ(p[0], 0xAA);
+    AssertIntEQ(p[1], 0xBB);
+
+    /* Exactly 8 pad bytes is the minimum accepted */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x01; blk[10] = 0x00; blk[11] = 0x5A;
+    p = blk; sz = 12;
+    AssertIntEQ(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+    AssertIntEQ(sz, 1);
+
+    /* Seven pad bytes must be rejected */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x01; blk[9] = 0x00; blk[10] = 0x5A;
+    p = blk; sz = 11;
+    AssertIntNE(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+
+    /* Wrong leading byte */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x01; blk[1] = 0x01; blk[10] = 0x00;
+    p = blk; sz = 12;
+    AssertIntNE(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+
+    /* Block type 2 must be rejected (this routine is type 1 only) */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x02; blk[10] = 0x00;
+    p = blk; sz = 12;
+    AssertIntNE(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+
+    /* No separator at all (all 0xFF tail) */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x01;
+    p = blk; sz = 16;
+    AssertIntNE(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+
+    /* Non-zero, non-FF byte where the separator belongs */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x01; blk[10] = 0x7E;
+    p = blk; sz = 16;
+    AssertIntNE(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+
+    /* Too short to hold a block */
+    for (i = 0; i < 3; i++) {
+        XMEMSET(blk, 0x00, sizeof(blk));
+        p = blk; sz = i;
+        AssertIntNE(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+    }
+
+    /* Separator as the final byte yields an empty payload */
+    XMEMSET(blk, 0xFF, sizeof(blk));
+    blk[0] = 0x00; blk[1] = 0x01; blk[11] = 0x00;
+    p = blk; sz = 12;
+    AssertIntEQ(TPM2_ASN_RsaUnpadPkcsv15(&p, &sz), 0);
+    AssertIntEQ(sz, 0);
+
+    printf("Test TPM Wrapper: %-40s Passed\n", "ASN RsaUnpadPkcsv15:");
+#endif
+}
+
 #if !defined(WOLFTPM2_NO_WRAPPER) && !defined(WOLFTPM2_NO_ASN)
 #include <examples/endorsement/trusted_certs_der.h>
 #endif
@@ -7237,6 +7310,7 @@ int unit_tests(int argc, char *argv[])
     test_wolfTPM2_CSR();
     test_wolfTPM2_CryptoDevCb_EccVerifyOversizedRS();
     test_TPM2_ASN_DecodeX509Cert_Errors();
+    test_TPM2_ASN_RsaUnpadPkcsv15();
     test_TPM2_ASN_DecodeX509Cert_Valid();
     test_TPM2_ASN_DecodeTag_Errors();
     #if !defined(WOLFTPM2_NO_WOLFCRYPT) && defined(WOLFTPM2_PEM_DECODE) && \