[dpdk-dev v2 1/2] eal: Add rte_consttime_memsq() to prevent timing attacks memcmp.
Stephen Hemminger
stephen at networkplumber.org
Fri Sep 26 20:07:52 CEST 2025
On Fri, 26 Sep 2025 15:49:04 +0000
Kai Ji <kai.ji at intel.com> wrote:
> Bugzilla ID: 1773
> Cc: stable at dpdk.org
>
> [0] https://bugs.dpdk.org/show_bug.cgi?id=1773
>
> Signed-off-by: Kai Ji <kai.ji at intel.com>
> ---
> lib/eal/include/rte_common.h | 34 ++++++++++++++++++++++++++++++++++
> 1 file changed, 34 insertions(+)
>
> diff --git a/lib/eal/include/rte_common.h b/lib/eal/include/rte_common.h
> index 9e7d84f929..ddbba083be 100644
> --- a/lib/eal/include/rte_common.h
> +++ b/lib/eal/include/rte_common.h
> @@ -700,6 +700,40 @@ rte_is_aligned(const void * const __rte_restrict ptr, const unsigned int align)
> return ((uintptr_t)ptr & (align - 1)) == 0;
> }
>
> +/**
> + * Constant-time memory inequality comparison.
> + *
> + * This function compares two memory regions in constant time, making it
> + * resistant to timing side-channel attacks. The execution time depends only
> + * on the length parameter, not on the actual data values being compared.
> + *
> + * This is particularly important for cryptographic operations where timing
> + * differences could leak information about secret keys, passwords, or other
> + * sensitive data.
> + *
> + * @param a
> + * Pointer to the first memory region to compare
> + * @param b
> + * Pointer to the second memory region to compare
> + * @param n
> + * Number of bytes to compare
> + * @return
> + * false if the memory regions are identical, true if they differ
> + */
> +static inline bool
> +rte_consttime_memneq(const void *a, const void *b, size_t n)
> +{
> + const volatile uint8_t *pa = (const volatile uint8_t *)a;
> + const volatile uint8_t *pb = (const volatile uint8_t *)b;
> + uint8_t result = 0;
> + size_t i;
> +
> + for (i = 0; i < n; i++)
> + result |= pa[i] ^ pb[i];
> +
> + return result != 0;
> +}
New functions usually have to be marked experimental.
Since DPDK adopts many things from FreeBSD, perhaps the function
should use the same naming conventions. That would mean
int rte_consttime_memequal(void *, void *, size_t len);
And will also need to update release notes.
More information about the dev
mailing list