Differential D497
Set vZZ.16b register to zero before use in armv8 gcm implementation Authored by larma on Jan 16 2020, 9:27 PM.
Details
The register vZZ.16b is expected to be always 0 throughout the macros in cipher/cipher-gcm-armv8-aarch64-ce.S. The PMUL_128x128 and REDUCTION macros are used in gcry_ghash_setup_armv8_ce_pmull function, however that function does not set vZZ.16b to zero. If previous use left `vZZ.16b non-zero before gcry_ghash_setup_armv8_ce_pmull is called, this will cause invalid GCM auth tag results. The patch resets vZZ.16b to 0 at the beginning of gcry_ghash_setup_armv8_ce_pmull. This fixes a bug when using the OMEMO encryption in Dino (XMPP client) on arm64 Debian bullseye (with dino-im package from Debian repository or when compiling current master from source). The first OMEMO encrypted message always worked fine, but every later message with more than 96 bytes had an invalid auth tag.
Diff Detail
Event TimelineComment Actions Thanks for bug fix. I've prepared patch and send it to mailing list https://lists.gnupg.org/pipermail/gcrypt-devel/2020-January/004885.html. Let me know if Reported-by is ok/enough. I would have liked to put you as author of commit, but this Differential interface of quite horrible and does not give all the needed information (mainly "name <email>" format for git). I've also prepared patch to tests/basic for better detecting this sort of bugs in future, https://lists.gnupg.org/pipermail/gcrypt-devel/2020-January/004884.html Comment Actions @jukivili thanks for looking into this. If you want, you can go with "Marvin W. <git at larma.de>" or just keep as is. Comment Actions Patch have been applied to master, https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=79ed620ec46adbb08f5cea6a4865a95a436e4109 This should also be applied to 1.8 branch. |