From e322dc9ad4501c5987d248f3a41f49b600cfb852 Mon Sep 17 00:00:00 2001
From: Pol Henarejos <pol.henarejos@cttc.es>
Date: Sun, 21 Jun 2026 20:01:31 +0200
Subject: [PATCH] Fix MAC verification constantness.

Signed-off-by: Pol Henarejos <pol.henarejos@cttc.es>
---
 src/eac.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/eac.c b/src/eac.c
index 0a8649e..e7a1277 100644
--- a/src/eac.c
+++ b/src/eac.c
@@ -27,6 +27,7 @@
 #else
 #include "usb/usb.h"
 #endif
+#include "mbedtls/constant_time.h"
 
 static uint8_t sm_nonce[8];
 static uint8_t sm_kmac[16];
@@ -305,7 +306,7 @@ int sm_verify(void) {
     if (r != 0) {
         return PICOKEYS_EXEC_ERROR;
     }
-    if (memcmp(signature, mac, mac_len) == 0) {
+    if (mbedtls_ct_memcmp(signature, mac, mac_len) == 0) {
         return PICOKEYS_OK;
     }
     return PICOKEYS_VERIFICATION_FAILED;