SM2 ciphertext authentication uses a prefix-leaking comparison

SM2 decryption recomputes the C3 digest and checks it with the ordinary memcmp routine. memcmp may stop at the first differing byte, making rejection time depend on the length of the correct digest prefix. This introduces a timing side channel in ciphertext authentication.

Vulnerable code

In cipher/ecc-sm2.c, function _gcry_ecc_sm2_decrypt:

c3 = mpi_get_opaque (data_c3, &c3_len);
c3_len = (c3_len + 7) / 8;
if (c3_len != mdlen || memcmp (dgst, c3, c3_len) != 0)
  {
    memset (plain, 0, inlen);
    rc = GPG_ERR_INV_DATA;
    goto leave_main;
  }

Why it matters

An attacker must submit many chosen ciphertexts to a stable, low-noise decryption oracle and distinguish small timing differences. Network jitter, allocation, elliptic-curve work, and hashing may swamp the signal, so practical digest recovery was not demonstrated. Nonetheless, authentication comparisons should not disclose correct-prefix length, especially in a decryption path handling adversarial data.

Proposed fix

After safely handling the public length mismatch, compare the full mdlen bytes with Libgcrypt's constant-time equality helper and map every mismatch to the same error. Ensure plaintext clearing remains unconditional on failure. Add correctness tests for mismatches at the first, middle, and last digest bytes, plus a statistical timing regression or instrumentation test confirming the constant-time helper is used.