Remove potential timing attack in RFC5649WrapEngine
@@ -215,12 +215,13 @@ public String getAlgorithmName()
isValid = false;
}
- // Check the number of padded zeros
+ // Check the number of padding zeros
int expectedZeros = upperBound - mli;
- if (expectedZeros >= paddedPlaintext.length || expectedZeros<0)
+ if (expectedZeros >= 8 || expectedZeros < 0)
{
+ // We have to pick a "typical" amount of padding to avoid timing attacks.
isValid = false;
- expectedZeros = paddedPlaintext.length;
+ expectedZeros = 4;
}
byte[] zeros = new byte[expectedZeros];
