From 97e979b3200034adcf4cf4f3bf1cccd52f48a1cd Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Sun, 18 Oct 2026 17:01:13 -0700 Subject: [PATCH] pkcs1v15: use `ctutils::CtGt` to address TODO --- src/algorithms/pkcs1v15.rs | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/src/algorithms/pkcs1v15.rs b/src/algorithms/pkcs1v15.rs index f4052555..a08357f2 100644 --- a/src/algorithms/pkcs1v15.rs +++ b/src/algorithms/pkcs1v15.rs @@ -8,7 +8,7 @@ use alloc::vec::Vec; use const_oid::AssociatedOid; -use crypto_bigint::{Choice, CtAssign, CtEq, CtSelect}; +use crypto_bigint::{Choice, CtAssign, CtEq, CtGt, CtSelect}; use digest::Digest; use rand_core::TryCryptoRng; use zeroize::Zeroizing; @@ -103,13 +103,9 @@ fn decrypt_inner(em: &[u8], k: usize) -> Result<(u8, u32)> { looking_for_index &= !equals0; } - // The PS padding must be at least 8 bytes long, and it starts two - // bytes into em. - // TODO: WARNING: THIS MUST BE CONSTANT TIME CHECK: - // Ref: https://github.com/dalek-cryptography/subtle/issues/20 - // This is currently copy & paste from the constant time impl in - // go, but very likely not sufficient. - let valid_ps = Choice::from_u8_lsb((((2i32 + 8i32 - index as i32 - 1i32) >> 31) & 1) as u8); + // PS starts at offset 2 and must contain at least 8 nonzero octets, + // so the first zero separator must occur at offset 10 or later. + let valid_ps = index.ct_gt(&9); let valid = first_byte_is_zero & second_byte_is_two & !looking_for_index & valid_ps; index = u32::ct_select(&0, &(index + 1), valid);