Const-time padding improvements

Author: peterdettman

core/src/main/java/org/bouncycastle/crypto/paddings/ISO10126d2Padding.java

@@ -61,9 +61,11 @@ public int addPadding(
     public int padCount(byte[] in)
         throws InvalidCipherTextException
     {
-        int count = in[in.length - 1] & 0xff;
+        int count = in[in.length - 1] & 0xFF;
+        int position = in.length - count;
 
-        if (count > in.length)
+        int failed = (position | (count - 1)) >> 31;
+        if (failed != 0)
         {
             throw new InvalidCipherTextException("pad block corrupted");
         }

core/src/main/java/org/bouncycastle/crypto/paddings/ISO7816d4Padding.java

@@ -60,18 +60,20 @@ public int addPadding(
     public int padCount(byte[] in)
         throws InvalidCipherTextException
     {
-        int count = in.length - 1;
-
-        while (count > 0 && in[count] == 0)
+        int position = -1, still00Mask = -1;
+        int i = in.length;
+        while (--i >= 0)
         {
-            count--;
+            int next = in[i] & 0xFF;
+            int match00Mask = ((next ^ 0x00) - 1) >> 31;
+            int match80Mask = ((next ^ 0x80) - 1) >> 31;
+            position ^= (i ^ position) & (still00Mask & match80Mask);
+            still00Mask &= match00Mask;
         }
-
-        if (in[count] != (byte)0x80)
+        if (position < 0)
         {
             throw new InvalidCipherTextException("pad block corrupted");
         }
-        
-        return in.length - count;
+        return in.length - position;
     }
 }

core/src/main/java/org/bouncycastle/crypto/paddings/PKCS7Padding.java

@@ -56,18 +56,16 @@ public int addPadding(
     public int padCount(byte[] in)
         throws InvalidCipherTextException
     {
-        int count = in[in.length - 1] & 0xff;
-        byte countAsbyte = (byte)count;
+        byte countAsByte = in[in.length - 1];
+        int count = countAsByte & 0xFF;
+        int position = in.length - count;
 
-        // constant time version
-        boolean failed = (count > in.length | count == 0);
-
-        for (int i = 0; i < in.length; i++)
+        int failed = (position | (count - 1)) >> 31;
+        for (int i = 0; i < in.length; ++i)
         {
-            failed |= (in.length - i <= count) & (in[i] != countAsbyte);
+            failed |= (in[i] ^ countAsByte) & ~((i - position) >> 31);
         }
-
-        if (failed)
+        if (failed != 0)
         {
             throw new InvalidCipherTextException("pad block corrupted");
         }

core/src/main/java/org/bouncycastle/crypto/paddings/TBCPadding.java

@@ -76,14 +76,15 @@ public int addPadding(
     public int padCount(byte[] in)
         throws InvalidCipherTextException
     {
-        byte code = in[in.length - 1];
-
-        int index = in.length - 1;
-        while (index > 0 && in[index - 1] == code)
+        int i = in.length;
+        int code = in[--i] & 0xFF, count = 1, countingMask = -1;
+        while (--i >= 0)
         {
-            index--;
+            int next = in[i] & 0xFF;
+            int matchMask = ((next ^ code) - 1) >> 31;
+            countingMask &= matchMask;
+            count -= countingMask;
         }
-
-        return in.length - index;
+        return count;
     }
 }

core/src/main/java/org/bouncycastle/crypto/paddings/X923Padding.java

@@ -68,9 +68,11 @@ public int addPadding(
     public int padCount(byte[] in)
         throws InvalidCipherTextException
     {
-        int count = in[in.length - 1] & 0xff;
+        int count = in[in.length - 1] & 0xFF;
+        int position = in.length - count;
 
-        if (count > in.length)
+        int failed = (position | (count - 1)) >> 31;
+        if (failed != 0)
         {
             throw new InvalidCipherTextException("pad block corrupted");
         }

core/src/main/java/org/bouncycastle/crypto/paddings/ZeroBytePadding.java

@@ -56,18 +56,15 @@ public int addPadding(
     public int padCount(byte[] in)
         throws InvalidCipherTextException
     {
-        int count = in.length;
-
-        while (count > 0)
+        int count = 0, still00Mask = -1;
+        int i = in.length;
+        while (--i >= 0)
         {
-            if (in[count - 1] != 0)
-            {
-                break;
-            }
-
-            count--;
+            int next = in[i] & 0xFF;
+            int match00Mask = ((next ^ 0x00) - 1) >> 31;
+            still00Mask &= match00Mask;
+            count -= still00Mask;
         }
-
-        return in.length - count;
+        return count;
     }
 }