Timing leak in RPC authentication

[pakt]

bitcoinrpc.cpp

bool HTTPAuthorized(map<string, string>& mapHeaders)
{
    string strAuth = mapHeaders["authorization"];
    if (strAuth.substr(0,6) != "Basic ")
        return false;
    string strUserPass64 = strAuth.substr(6); boost::trim(strUserPass64);
    string strUserPass = DecodeBase64(strUserPass64);
    return strUserPass == strRPCUserColonPass;
}

Last string comparision strUserPass == strRPCUserColonPass gets compiled to:

    do
    {
      if ( !len )
        break;
      less = *(_BYTE *)strUserPass < *(_BYTE *)strRPCUserColonPass;
      eq = *(_BYTE *)strUserPass++ == *(_BYTE *)strRPCUserColonPass++;
      --len;
    }
    while ( eq );

which is a byte-by-byte compare. Attacker with precise clock (being in the same LAN, for example) might learn the RPC password letter by letter, by trying passwords like 'a...", "b...", "c..." and observing which took the longest time to verify.

This code in bitcoinrpc.cpp:

            if (mapArgs["-rpcpassword"].size() < 20)
                MilliSleep(250);

protects from bruteforce for short password. Unfortunately, when run, bitcoind suggest a 32 chars password. Paradoxically short passwords are safer to use than longer ones, wrt to the timing leak.

Here's an example of time independent array comparison: http://rdist.root.org/2010/01/07/timing-independent-array-comparison/

[jgarzik]

It's Basic authentication; easier just to decode the base64 ;p

[gmaxwell]

@jgarzik he doesn't mean timing an actual authentication session, he means that even absent a user who knows the password an attacker who could reach the rpc port could analyze the timing of the rejections to derive the password one character at a time because the comparison shortcuts and thus returns faster when the error is at the front.

If you've exposed your rpc port to an attacker— life is probably not good for you to begin with. But this should probably using a constant time comparison and also delay all failures. I'll look into it.

[fgeek]

Please use CVE-2013-4165 for this issue as per http://openwall.com/lists/oss-security/2013/07/24/7

[laanwj]

Solved by #2886