Time Invariant String Comparison
[
Date Prev][
Date Next][
Thread Prev][
Thread Next]
[
Date Index]
[
Thread Index]
- Subject: Time Invariant String Comparison
- From: "Jason A. Donenfeld" <Jason@...>
- Date: 2014年1月16日 12:44:53 +0100
Hi guys,
Over at cgit [1] we use Lua for our authentication framework [2]. One
thing we're doing wrong is lines like these:
if password == post["password"] then
Since an attacker can control the post params, this test is vulnerable
to a timing attack, by which an attacker could determine the password
one character at a time by analysis of response time.
What I'm looking for is some clever way in Lua to compare two strings
in a time invariant way. Any suggestions?
Thanks,
Jason
[1] http://git.zx2c4.com/cgit/
[2] http://git.zx2c4.com/cgit/tree/filters/simple-authentication.lua