CyberRota Analysis
AI-GeneratedThe vulnerability arises in the ChunkedMacVerification object within Tink, where the tag verification process employs a non-constant time comparison, exposing it to timing attacks. This could enable an attacker to exploit timing information to incrementally discover matching bytes of the tag, potentially compromising the integrity of the cryptographic verification. Developers and organizations using Tink for cryptographic operations should prioritize addressing this issue to mitigate the risk of side-channel attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.