From 69bafce7a32ac2b95fe859fa5c763b3857720c62 Mon Sep 17 00:00:00 2001
From: Andrzej Kurek <andrzej.kurek@arm.com>
Date: Sat, 19 Sep 2020 12:45:20 +0200
Subject: [PATCH] Improve the FI resistance in ssl_tls.c key switching

Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
---
 library/ssl_tls.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 89ac9b47e..e00dd0147 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -63,12 +63,14 @@ static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
                                    const mbedtls_operation_t operation )
 {
     unsigned char * key;
-    int ret;
+    int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
+    int flow_ctrl = 0;
 #if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
     uint32_t hash;
 #endif
     if( operation == MBEDTLS_ENCRYPT )
     {
+        flow_ctrl++;
         key = transform->key_enc;
 #if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
         hash = transform->key_enc_hash;
@@ -76,6 +78,7 @@ static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
     }
     else if ( operation == MBEDTLS_DECRYPT )
     {
+        flow_ctrl++;
         key = transform->key_dec;
 #if defined(MBEDTLS_VALIDATE_SSL_KEYS_INTEGRITY)
         hash = transform->key_dec_hash;
@@ -91,6 +94,12 @@ static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
     {
         return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
     }
+    else
+    {
+        flow_ctrl++;
+    }
+#else
+    flow_ctrl++;
 #endif
     if( operation != transform->cipher_ctx.operation )
     {
@@ -102,7 +111,11 @@ static int mbedtls_ssl_switch_key( mbedtls_ssl_transform *transform,
             return( ret );
         }
     }
-    return( 0 );
+    if( flow_ctrl == 2 )
+    {
+        return( 0 );
+    }
+    return( MBEDTLS_ERR_PLATFORM_FAULT_DETECTED );
 }
 #endif