From 87bbfe4f5f26b8f8e15626a17746b84b479ac679 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 12 Jun 2026 13:06:41 +0200 Subject: [PATCH] gcm: Implement block multiplication in constant time --- src/libstrongswan/plugins/gcm/gcm_aead.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/src/libstrongswan/plugins/gcm/gcm_aead.c b/src/libstrongswan/plugins/gcm/gcm_aead.c index edd224c03..ec2206c50 100644 --- a/src/libstrongswan/plugins/gcm/gcm_aead.c +++ b/src/libstrongswan/plugins/gcm/gcm_aead.c @@ -106,8 +106,8 @@ static void sr_block(char *block) */ static void mult_block(char *x, char *y, char *res) { - char z[BLOCK_SIZE], v[BLOCK_SIZE], r; - int bit, byte; + uint8_t z[BLOCK_SIZE], v[BLOCK_SIZE], r, mask; + int bit, byte, i; r = 0xE1; memset(z, 0, BLOCK_SIZE); @@ -117,19 +117,14 @@ static void mult_block(char *x, char *y, char *res) { for (bit = 7; bit >= 0; bit--) { - if (x[byte] & (1 << bit)) + mask = constant_time_mask(x[byte] & (1 << bit)); + for (i = 0; i < BLOCK_SIZE; i++) { - memxor(z, v, BLOCK_SIZE); - } - if (v[BLOCK_SIZE - 1] & 0x01) - { - sr_block(v); - v[0] ^= r; - } - else - { - sr_block(v); + z[i] ^= v[i] & mask; } + mask = constant_time_mask(v[BLOCK_SIZE - 1] & 0x01); + sr_block(v); + v[0] ^= r & mask; } } memcpy(res, z, BLOCK_SIZE);