- MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen);
- for (i = lzero; i < SHA_DIGEST_LENGTH; i++)
- seed[i] ^= from[i - lzero];
+ /* Always do this zero-padding copy (even when lzero == 0)
+ * to avoid leaking timing info about the value of lzero. */
+ padded_from = db + dblen;
+ memset(padded_from, 0, lzero);
+ memcpy(padded_from + lzero, from, flen);
+
+ maskeddb = padded_from + SHA_DIGEST_LENGTH;
+
+ if (MGF1(seed, SHA_DIGEST_LENGTH, maskeddb, dblen))
+ return -1;
+ for (i = 0; i < SHA_DIGEST_LENGTH; i++)
+ seed[i] ^= padded_from[i];