* Time Invariant String Comparison
@ 2014-01-16 11:44 Jason
0 siblings, 0 replies; only message in thread
From: Jason @ 2014-01-16 11:44 UTC (permalink / raw)
Hi guys,
Over at cgit [1] we use Lua for our authentication framework [2]. One
thing we're doing wrong is lines like these:
if password == post["password"] then
Since an attacker can control the post params, this test is vulnerable
to a timing attack, by which an attacker could determine the password
one character at a time by analysis of response time.
What I'm looking for is some clever way in Lua to compare two strings
in a time invariant way. Any suggestions?
Thanks,
Jason
[1] http://git.zx2c4.com/cgit/
[2] http://git.zx2c4.com/cgit/tree/filters/simple-authentication.lua
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-01-16 11:44 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-01-16 11:44 Time Invariant String Comparison Jason
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).