Re: [PATCH] crypto: sa2ul - use crypto_memneq() to compare AEAD tag

[Herbert Xu]

On Fri, Aug 07, 2026 at 05:44:16PM +0200, David C.C.M. Gall wrote:
> Use crypto_memneq() for a constant-time comparison.
> 
> sa_aead_dma_in_callback() compares the computed authentication tag
> against the received tag with memcmp(), which short-circuits on the
> first differing byte. An attacker who can submit decrypt requests and
> observe completion latency could recover the expected tag byte by byte.
> 
> Valid tag forgery for AEAD breaks the INT-CTXT guarantee.
> 
> Assisted-by: gregkh_clanker_t1000
> Signed-off-by: David C.C.M. Gall <david.ccm.gall@xxxxxxxxxxxxxx>
> ---
>  drivers/crypto/sa2ul.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt