-
Notifications
You must be signed in to change notification settings - Fork 15
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Timing attack fix #16
Conversation
' against timing attacks when comparing hashes
…"" and "\NUL" match on almost all algorithms
I am very much not a security auditor. But yes this looks fine to me. |
Co-authored-by: Dennis Gosnell <cdep.illabout@gmail.com>
@maralorn Of course, but just checking that I've adjusted it at the correct location where you found the issue. |
So it builds and addresses the issue, shall I just merge and upload later today? |
@Vlix Yes, please do! Also, you may want to deprecate version 2.0.0.0 and 2.0.0.1 using the Hackage UI so that people know not to use it. |
@cdepillabout because it doesn't have the |
I'd be fine with that as well. Although thinking more critically about this, I guess it depends on how big of a problem this is. Are people likely to have accounts compromised because of not using a constant-time equals? If so, then we should deprecate. If not, then it is probably not a problem, and we don't have to deprecate old versions. |
Added in the
constEq
anywhere hashes are being compared.Also cleaned up tests, since with low rounds we can just run 100 on the property tests.