Add PK_Decryptor::decrypt_or_random

Performs content checks on the value (expected length, expected bytes)
and in constant time returns either the decrypted value or a random value.

1 files changed, 5 insertions, 3 deletions

diff --git a/src/lib/pubkey/dlies/dlies.cpp b/src/lib/pubkey/dlies/dlies.cpp
index ba890ac3d..2c98966b0 100644
--- a/src/lib/pubkey/dlies/dlies.cpp
+++ b/src/lib/pubkey/dlies/dlies.cpp
@@ -6,6 +6,7 @@
 */
 
 #include <botan/dlies.h>
+#include <botan/internal/ct_utils.h>
 
 namespace Botan {
 
@@ -97,7 +98,8 @@ DLIES_Decryptor::DLIES_Decryptor(const PK_Key_Agreement_Key& key,
 /*
 * DLIES Decryption
 */
-secure_vector<byte> DLIES_Decryptor::dec(const byte msg[], size_t length) const
+secure_vector<byte> DLIES_Decryptor::do_decrypt(byte& valid_mask,
+                                                const byte msg[], size_t length) const
    {
    if(length < m_my_key.size() + m_mac->output_length())
       throw Decoding_Error("DLIES decryption: ciphertext is too short");
@@ -124,8 +126,8 @@ secure_vector<byte> DLIES_Decryptor::dec(const byte msg[], size_t length) const
    for(size_t j = 0; j != 8; ++j)
       m_mac->update(0);
    secure_vector<byte> T2 = m_mac->final();
-   if(T != T2)
-      throw Decoding_Error("DLIES: message authentication failed");
+
+   valid_mask = CT::expand_mask<byte>(same_mem(T.data(), T2.data(), T.size()));
 
    xor_buf(C, K.data() + m_mac_keylen, C.size());