Update to NSS 3.14.3 Beta 1 for the TLS CBC constant-time

mozilla/security/nss/lib/freebl/md5.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifdef FREEBL_NO_DEPEND
 #include "stubs.h"
 #endif
 
 #include "prerr.h"
 #include "secerr.h"
@@ skipping 505 matching lines @@
         cx->u.w[14] = lendian(lowInput);
         cx->u.w[15] = lendian(highInput);
 
         /* Final call to compress. */
 #ifndef IS_LITTLE_ENDIAN
         md5_prep_state_le(cx);
 #endif
         md5_compress(cx, cx->u.w);
 
         /* Copy the resulting values out of the chain variables into return buf. */
-        *digestLen = MD5_HASH_LEN;
+        if (digestLen)
+                *digestLen = MD5_HASH_LEN;
 #ifndef IS_LITTLE_ENDIAN
         cx->cv[0] = lendian(cx->cv[0]);
         cx->cv[1] = lendian(cx->cv[1]);
         cx->cv[2] = lendian(cx->cv[2]);
         cx->cv[3] = lendian(cx->cv[3]);
 #endif
         memcpy(digest, cx->cv, MD5_HASH_LEN);
 }
 
+void
+MD5_EndRaw(MD5Context *cx, unsigned char *digest,
+           unsigned int *digestLen, unsigned int maxDigestLen)
+{
+#ifndef IS_LITTLE_ENDIAN
+        PRUint32 tmp;
+#endif
+        PRUint32 cv[4];
+
+        if (maxDigestLen < MD5_HASH_LEN) {
+                PORT_SetError(SEC_ERROR_INVALID_ARGS);
+                return;
+        }
+
+        memcpy(cv, cx->cv, sizeof(cv));

[wtc, 2013/02/08 02:17:52]

Why do the <Hash>_EndRaw functions need to copy the
result in the |cx| to a local buffer and swap the bytes
there?

[agl, 2013/02/08 02:26:03]

(Late - brain may not be working.)

The EndRaw functions are called multiple times on a given hash and they cannot
be destructive. When hashing a message we'll hash most of it, EndRaw, hash
another block, EndRaw, etc.

That's because the point where we stop taking EndRaw is secret, so we always
EndRaw for every block that might contain the end and pick the result from the
right one (in constant time).

+#ifndef IS_LITTLE_ENDIAN
+        cv[0] = lendian(cv[0]);
+        cv[1] = lendian(cv[1]);
+        cv[2] = lendian(cv[2]);
+        cv[3] = lendian(cv[3]);
+#endif
+        memcpy(digest, cv, MD5_HASH_LEN);
+        if (digestLen)
+                *digestLen = MD5_HASH_LEN;
+}
+
 unsigned int 
 MD5_FlattenSize(MD5Context *cx)
 {
         return sizeof(*cx);
 }
 
 SECStatus 
 MD5_Flatten(MD5Context *cx, unsigned char *space)
 {
         memcpy(space, cx, sizeof(*cx));
@@ skipping 12 matching lines @@
 void MD5_Clone(MD5Context *dest, MD5Context *src) 
 {
         memcpy(dest, src, sizeof *dest);
 }
 
 void 
 MD5_TraceState(MD5Context *cx)
 {
         PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
 }