thunderbolt: HMAC fix and cleanup

Patch 1 fixes the HMAC comparison in the thunderbolt driver to be constant-time.

Patch 2 simplifies the HMAC computation in the thunderbolt driver by using the library API instead of crypto_shash. Note that this depends on the HMAC-SHA256 library API that was merged for v6.17-rc1.

Eric Biggers (2):
thunderbolt: Compare HMAC values in constant time
thunderbolt: Use HMAC-SHA256 library instead of crypto_shash

 drivers/thunderbolt/Kconfig  |  4 ++--
 drivers/thunderbolt/domain.c | 45 ++++++------------------------------
 2 files changed, 9 insertions(+), 40 deletions(-)

base-commit: d6084bb815c453de27af8071a23163a711586a6c

2.50.1

To prevent timing attacks, HMAC value comparison needs to be constant time. Replace the memcmp() with the correct function, crypto_memneq().

---
 drivers/thunderbolt/domain.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 45239703745e5..7e0eb3c07f1c7 100644
@@ -11,10 +11,11 @@
 #include <linux/module.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
 #include <linux/random.h>
 #include <crypto/hash.h>
+#include <crypto/utils.h>
 
 #include "tb.h"
 
 static DEFINE_IDA(tb_domain_ida);
 

@@ -746,11 +747,11 @@ int tb_domain_challenge_switch_key(struct tb *tb, struct tb_switch *sw)
 	ret = crypto_shash_digest(shash, challenge, sizeof(hmac), hmac);
 	if (ret)
 		goto err_free_shash;
 
 	/* The returned HMAC must match the one we calculated */
-	if (memcmp(response, hmac, sizeof(hmac))) {
+	if (crypto_memneq(response, hmac, sizeof(hmac))) {
 		ret = -EKEYREJECTED;
 		goto err_free_shash;
 	}
 
 	crypto_free_shash(tfm);

2.50.1

Use the hmac_sha256_usingrawkey() library function instead of the "hmac(sha256)" crypto_shash. This is simpler and faster.

As a cleanup, change the input data parameters from "challenge, sizeof(hmac)" to "challenge, sizeof(challenge)", so that the size is being taken of the correct buffer. This is not a functional change, since it happens that sizeof(hmac) == sizeof(challenge).

Replace the selection of CRYPTO and CRYPTO_HASH with CRYPTO_LIB_SHA256 and CRYPTO_LIB_UTILS. The latter is needed for crypto_memneq() which was previously being pulled in via CRYPTO.

---
 drivers/thunderbolt/Kconfig  |  4 ++--
 drivers/thunderbolt/domain.c | 44 +++++-------------------------------
 2 files changed, 8 insertions(+), 40 deletions(-)

index 0abdb69ee9f43..db3b0bef48f4c 100644
@@ -2,12 +2,12 @@
 menuconfig USB4
 	tristate "Unified support for USB4 and Thunderbolt"
 	depends on PCI
 	select APPLE_PROPERTIES if EFI_STUB && X86
 	select CRC32
-	select CRYPTO
-	select CRYPTO_HASH
+	select CRYPTO_LIB_SHA256
+	select CRYPTO_LIB_UTILS
 	select NVMEM
 	help
 	  USB4 and Thunderbolt driver. USB4 is the public specification
 	  based on the Thunderbolt 3 protocol. This driver is required if
 	  you want to hotplug Thunderbolt and USB4 compliant devices on

2.50.1

Both applied to thunderbolt.git/next, thanks!