From: bartdewater@gmail.com
To: ruby-core@ruby-lang.org
Subject: [ruby-core:94409] [Ruby master Feature#10098] [PATCH] Timing-safe string comparison for OpenSSL::HMAC
Date: Sun, 18 Aug 2019 05:17:50 +0000 (UTC) [thread overview]
Message-ID: <redmine.journal-80831.20190818051749.f72b5bd4c0e5f545@ruby-lang.org> (raw)
In-Reply-To: redmine.issue-10098.20140728145821@ruby-lang.org
Issue #10098 has been updated by bdewater (Bart de Water).
New patch over at https://github.com/ruby/openssl/pull/269
----------------------------------------
Feature #10098: [PATCH] Timing-safe string comparison for OpenSSL::HMAC
https://bugs.ruby-lang.org/issues/10098#change-80831
* Author: arrtchiu (Matt U)
* Status: Assigned
* Priority: Normal
* Assignee: openssl
* Target version:
----------------------------------------
I could be totally wrong, but it seems the standard library doesn't provide a reliable way of comparing hashes in constant-time.
* The docs for `OpenSSL::HMAC` encourage the use of `Digest#to_s` (see: http://ruby-doc.org/stdlib-2.1.0/libdoc/openssl/rdoc/OpenSSL/HMAC.html#method-c-new )
* Ruby's string comparison uses memcmp, which isn't timing safe (see: http://rxr.whitequark.org/mri/source/string.c#2382 )
With this patch I propose to add an additional method, `OpenSSL::HMAC#verify`, which takes a binary string with a digest and compares it against the computed hash.
---Files--------------------------------
hmac-timing.patch (2.5 KB)
hmac-timing.patch (2.48 KB)
tsafe_eql.patch (2.48 KB)
tsafe_inline.patch (3.51 KB)
0001-add-timing-safe-string-compare-method.patch (4.31 KB)
--
https://bugs.ruby-lang.org/
next prev parent reply other threads:[~2019-08-18 5:17 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <redmine.issue-10098.20140728145821@ruby-lang.org>
2014-07-28 14:58 ` [ruby-core:64101] [ruby-trunk - Feature #10098] [Open] [PATCH] Timing-safe string comparison for OpenSSL::HMAC arrtchiu
2014-07-28 15:13 ` [ruby-core:64102] [ruby-trunk - Feature #10098] " arrtchiu
2014-07-29 1:25 ` [ruby-core:64106] " nobu
2014-07-29 1:39 ` [ruby-core:64107] " arrtchiu
2014-07-29 2:01 ` [ruby-core:64108] " nobu
2014-07-29 3:56 ` [ruby-core:64110] " arrtchiu
2014-07-29 5:26 ` [ruby-core:64112] " nobu
2014-07-29 5:47 ` [ruby-core:64113] " nobu
2014-07-29 5:59 ` [ruby-core:64114] " arrtchiu
2014-07-29 7:35 ` [ruby-core:64115] " nobu
2014-07-29 10:30 ` [ruby-core:64118] " arrtchiu
2014-07-29 16:31 ` [ruby-core:64120] " nobu
2014-07-29 19:10 ` [ruby-core:64121] " cremno
2014-07-30 2:07 ` [ruby-core:64123] " arrtchiu
2014-07-30 12:56 ` [ruby-core:64125] " cremno
2014-08-23 9:12 ` [ruby-core:64508] " arrtchiu
2014-09-18 9:50 ` [ruby-core:65104] " arrtchiu
2014-10-29 8:52 ` [ruby-core:65988] [ruby-trunk - Feature #10098] [Assigned] " nagachika00
2015-09-13 3:31 ` [ruby-core:70792] [Ruby trunk - Feature #10098] " zzak
2016-02-06 17:28 ` [ruby-core:73724] [Ruby trunk Feature#10098] " aleksandrs
2016-02-25 6:42 ` [ruby-core:73970] " arrtchiu
2016-03-02 3:41 ` [ruby-core:74087] " naruse
2016-03-17 5:42 ` [ruby-core:74393] " shyouhei
2016-04-15 12:32 ` [ruby-core:74968] " naruse
2016-07-05 9:51 ` [ruby-core:76268] " arrtchiu
2016-09-07 8:55 ` [ruby-core:77201] [Ruby trunk Feature#10098][Feedback] " naruse
2016-09-27 9:07 ` [ruby-core:77423] [Ruby trunk Feature#10098] " shyouhei
2016-09-27 12:20 ` [ruby-core:77426] " aleksandrs
2016-09-27 12:44 ` [ruby-core:77427] " zn
2016-09-27 13:37 ` [ruby-core:77429] " nobu
2016-09-28 0:57 ` [ruby-core:77432] " shyouhei
2018-06-18 1:49 ` [ruby-core:87505] " shyouhei
2018-06-25 20:43 ` [ruby-core:87633] " bartdewater
2019-02-04 12:55 ` [ruby-core:91392] " shevegen
2019-02-07 7:40 ` [ruby-core:91459] " naruse
2019-08-18 5:17 ` bartdewater [this message]
2019-10-20 18:21 ` [ruby-core:95440] [Ruby master " bartdewater
2019-10-21 2:09 ` [ruby-core:95447] " shyouhei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.ruby-lang.org/en/community/mailing-lists/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=redmine.journal-80831.20190818051749.f72b5bd4c0e5f545@ruby-lang.org \
--to=ruby-core@ruby-lang.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).