Skip to content

[PATCH v1] Fix AES-GCM tag check#23

Closed
lumag wants to merge 2 commits intoOpenDataPlane:masterfrom
lumag:crypto-gcm
Closed

[PATCH v1] Fix AES-GCM tag check#23
lumag wants to merge 2 commits intoOpenDataPlane:masterfrom
lumag:crypto-gcm

Conversation

@lumag
Copy link
Copy Markdown

@lumag lumag commented May 5, 2017

No description provided.

Dmitry Eremin-Solenikov added 2 commits May 5, 2017 04:13
Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>
Currently odp_crypto code will happily accept wrong tags, because the
check for EVP_DecryptFinal_ex return code is incorrect. This function
returns 0 if tag is incorrect, not < 0.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>
@muvarov muvarov changed the title Fix AES-GCM tag check [PATCH v1] Fix AES-GCM tag check May 5, 2017
@lumag
Copy link
Copy Markdown
Author

lumag commented May 17, 2017

@Bill-Fischofer-Linaro ping
This fixes security issue. Opened a bug at https://bugs.linaro.org/show_bug.cgi?id=3003

Copy link
Copy Markdown
Contributor

@Bill-Fischofer-Linaro Bill-Fischofer-Linaro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed-and-tested-by: Bill Fischofer bill.fischofer@linaro.org

@lumag
Copy link
Copy Markdown
Author

lumag commented May 19, 2017

@muvarov could you please merge this PR?

@muvarov
Copy link
Copy Markdown
Contributor

muvarov commented May 19, 2017

Merged.

@muvarov muvarov closed this May 19, 2017
@lumag
Copy link
Copy Markdown
Author

lumag commented May 19, 2017

@muvarov It had to be merged into master branch, not api-next! Master branch still contains this vulnerability.

BTW: why are you merging PRs by manually applying paches, rather than merging the original branch into it?

@lumag lumag deleted the crypto-gcm branch May 31, 2017 20:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants