Compare UDP authentication tags in constant time

gumble/gumble/crypt.go

@@ -3,6 +3,7 @@ package gumble
 import (
 	"crypto/aes"
 	"crypto/cipher"
+	"crypto/subtle"
 	"encoding/binary"
 	"errors"
 	"sync"
@@ -201,10 +202,8 @@ func ocbCrypt(block cipher.Block, nonce, data, ad []byte, encrypt bool) ([]byte,
 		out = append(out, offset[:tagLen]...)
 	} else {
 		tag := data[len(data)-tagLen:]
-		for j := 0; j < tagLen; j++ {
-			if tag[j] != offset[j] {
-				return nil, errors.New("gumble: OCB authentication failed")
-			}
+		if subtle.ConstantTimeCompare(tag, offset[:tagLen]) != 1 {
+			return nil, errors.New("gumble: OCB authentication failed")
 		}
 	}
 	return out, nil

gumble/gumble/udp15.go

@@ -3,6 +3,7 @@ package gumble
 import (
 	"bytes"
 	"crypto/aes"
+	"crypto/subtle"
 	"encoding/binary"
 	"errors"
 	"math"
@@ -314,7 +315,7 @@ func (cs *cryptState15) decrypt15(packet []byte) ([]byte, error) {
 	}
 
 	// Verify first 3 bytes of tag.
-	if tag[0] != expectedTag[0] || tag[1] != expectedTag[1] || tag[2] != expectedTag[2] {
+	if subtle.ConstantTimeCompare(tag[:3], expectedTag) != 1 {
 		cs.decryptIV = savedIV
 		return nil, errors.New("gumble: OCB authentication failed")
 	}