Harden ConstantCompare() and use it for the ATECC GCM tag check

Author: stenslae

.wolfssl_known_macro_extras

@@ -1058,6 +1058,7 @@ WOLFSSL_NO_CHACHA20_POLY1305_FUSED_IFMA
 WOLFSSL_NO_CHACHA20_POLY1305_SHORT
 WOLFSSL_NO_CHACHA20_POLY1305_SMALL_ASM
 WOLFSSL_NO_CLIENT_CERT_ERROR
+WOLFSSL_NO_CONST_CMP
 WOLFSSL_NO_COPY_CERT
 WOLFSSL_NO_COPY_KEY
 WOLFSSL_NO_CRL_DATE_CHECK

ChangeLog.md

@@ -112,6 +112,12 @@
   one wider than the modulus, instead of computing a result. by @stenslae
   (PR 11159)
 
+* **Behavioral change (`WOLFSSL_NO_CONST_CMP`)**: no longer defined
+  automatically. The minimal `WOLFCRYPT_ONLY` builds that got it now define
+  `WC_NO_CONST_CMP_API` instead, which leaves out only the exported
+  `wc_ConstantCompare()`; the internal `ConstantCompare()` stays available to
+  RSA, ECC and its other callers. by @stenslae (PR 11159)
+
 ## Post-Quantum Cryptography (PQC)
 
 * Added opt-in per-key Falcon signing caches (`--enable-falcon=cache-key`, `cache-basis`), roughly doubling signing speed with the default integer fpr backend. by @Frauschi
@@ -127,6 +133,7 @@
 * ECCSI signing (`wc_SignEccsiHash()`) now blinds its modular inverse instead of inverting the secret value directly. by @stenslae (PR 11159)
 * SAKKE RSK derivation now blinds the inverse of a + z_T, which involves the KMS master secret. by @stenslae (PR 11159)
 * Heap-math (`--enable-heapmath`) `mp_addmod_ct()`, `mp_submod_ct()` and `mp_div_2_mod_ct()` no longer branch on the values or limb counts of reduced operands. by @stenslae (PR 11159)
+* The ATECC GCM tag check now compares in constant time with `ConstantCompare()`, whose loads are now volatile so it cannot be compiled to an early-exit compare. by @stenslae (PR 11159)
 
 * Fixed `wc_AsconAEAD128_SetAD` called more than once: the function
   absorbs the key, nonce and associated data into the sponge state and then

wolfcrypt/src/memory.c

@@ -1737,7 +1737,7 @@ void wc_ForceZero(void *mem, size_t len)
 }
 #endif
 
-#ifndef WOLFSSL_NO_CONST_CMP
+#if !defined(WOLFSSL_NO_CONST_CMP) && !defined(WC_NO_CONST_CMP_API)
 /* Exported version of ConstantCompare(). */
 int wc_ConstantCompare(const byte* a, const byte* b, int length)
 

wolfcrypt/src/misc.c

@@ -832,9 +832,13 @@ WC_MISC_STATIC WC_INLINE int ConstantCompare(const byte* a, const byte* b,
 {
     int i;
     int compareSum = 0;
+    /* Volatile loads keep the compiler from turning this into an early-exit
+     * memcmp() or a vectorised compare-and-branch. */
+    const volatile byte* va = (const volatile byte*)a;
+    const volatile byte* vb = (const volatile byte*)b;
 
     for (i = 0; i < length; i++) {
-        compareSum |= a[i] ^ b[i];
+        compareSum |= va[i] ^ vb[i];
     }
 
     return compareSum;

wolfcrypt/src/port/atmel/atmel.c

@@ -2037,7 +2037,7 @@ static int wc_Microchip_AesGcmCommon(Aes* aes, byte* out, const byte* in,
                                            in, sz, out, tag_buf);
             if (status == ATCA_SUCCESS) {
                 copy_sz = authTagSz;
-                if (XMEMCMP(tag_buf, authTag, copy_sz) != 0) {
+                if (ConstantCompare(tag_buf, authTag, (int)copy_sz) != 0) {
                     return AES_GCM_AUTH_E;
                 }
             }

wolfssl/wolfcrypt/memory.h

@@ -335,7 +335,7 @@ WOLFSSL_LOCAL void wc_MemZero_Check(void* addr, size_t len);
 WOLFSSL_API void wc_ForceZero(void *mem, size_t len);
 #endif
 
-#ifndef WOLFSSL_NO_CONST_CMP
+#if !defined(WOLFSSL_NO_CONST_CMP) && !defined(WC_NO_CONST_CMP_API)
 WOLFSSL_API int wc_ConstantCompare(const byte* a, const byte* b, int length);
 #endif
 

wolfssl/wolfcrypt/settings.h

@@ -5312,10 +5312,12 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
     #define WOLFSSL_NO_CT_OPS
 #endif
 
+/* Minimal wolfCrypt-only builds leave out the exported wc_ConstantCompare().
+ * The internal ConstantCompare() stays available to its callers. */
 #if defined(WOLFCRYPT_ONLY) && defined(NO_AES) && !defined(HAVE_CURVE25519) && \
         !defined(HAVE_CURVE448) && defined(WC_NO_RNG) && defined(WC_NO_RSA_OAEP)
-    #undef  WOLFSSL_NO_CONST_CMP
-    #define WOLFSSL_NO_CONST_CMP
+    #undef  WC_NO_CONST_CMP_API
+    #define WC_NO_CONST_CMP_API
 #endif
 
 #if defined(WOLFCRYPT_ONLY) && defined(NO_AES) && !defined(WOLFSSL_SHA384) && \