Re: [PATCH] crypto: pkcs7_verify: use constant-time comparison for digest and signature verification

[James Bottomley]

On Fri, 2026-07-10 at 19:30 +0200, David C.C.M. Gall wrote:
> Replace memcmp() with crypto_memneq() for cryptographic digest and
> signature comparisons to prevent timing side-channel attacks.
> 
> crypto/asymmetric_keys/pkcs7_verify.c: PKCS#7 message digest
> comparison during signature verification passes argument pkcs7 and
> attached signatures to pkcs7_digest via pkcs7_verify_one.
> pkcs7_digest utilized memcmp which could leak valid prefix length for
> attached signatures via timing side-channel.

Please explain how this information is usable by an attacker?  The
assumption is the attacker sees the module (or whatever is signed) so
the pkcs7 digest is inside the signature in plain text and the digest
of the entity being compared should be computable by any attacker.

Regards,

James