Filippo Valsorda f28cf8346c crypto/tls: implement countermeasures against CBC padding oracles ... The aim is to make the decrypt() timing profile constant, irrespective of the CBC padding length or correctness. The old algorithm, on valid padding, would only MAC bytes up to the padding length threshold, making CBC ciphersuites vulnerable to plaintext recovery attacks as presented in the "Lucky Thirteen" paper. The new algorithm Write()s to the MAC all supposed payload, performs a constant time Sum()---which required implementing a constant time Sum() in crypto/sha1, see the "Lucky Microseconds" paper---and then Write()s the rest of the data. This is performed whether the padding is good or not. This should have no explicit secret-dependent timings, but it does NOT attempt to normalize memory accesses to prevent cache timing leaks. Updates #13385 Change-Id: I15d91dc3cc6eefc1d44f317f72ff8feb0a9888f7 Reviewed-on: https://go-review.googlesource.com/18130 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>		2016-10-04 13:21:02 +00:00
..
example_test.go	crypto/md5, crypto/sha1, crypto/sha256: add examples for checksumming a file	2016-09-19 17:29:19 +00:00
fallback_test.go
issue15617_test.go	crypto/sha1: fix AVX2 variant on AMD64	2016-05-26 11:34:32 +00:00
sha1_test.go	crypto/tls: implement countermeasures against CBC padding oracles	2016-10-04 13:21:02 +00:00
sha1.go	crypto/tls: implement countermeasures against CBC padding oracles	2016-10-04 13:21:02 +00:00
sha1block_386.s
sha1block_amd64.go	crypto/sha1: fix AVX2 variant on AMD64	2016-05-26 11:34:32 +00:00
sha1block_amd64.s
sha1block_amd64p32.s	crypto/*, runtime: nacl asm fixes	2016-08-22 19:50:41 +00:00
sha1block_arm.s
sha1block_decl.go
sha1block_generic.go
sha1block_s390x.go
sha1block_s390x.s
sha1block.go