Re: Time Invariant String Comparison

[Daniel Silverstone <dsilvers@...>]

On Thu, Jan 16, 2014 at 12:44:53 +0100, Jason A. Donenfeld wrote:
> Over at cgit [1] we use Lua for our authentication framework [2]. One
> thing we're doing wrong is lines like these:
> 
> 	if password == post["password"] then
> 
> Since an attacker can control the post params, this test is vulnerable
> to a timing attack, by which an attacker could determine the password
> one character at a time by analysis of response time.
> 
> What I'm looking for is some clever way in Lua to compare two strings
> in a time invariant way. Any suggestions?

Lua's strings are interned and hashed.  As a result, string comparison for
equality is pretty much constant time :)

D.

-- 
Daniel Silverstone                         http://www.digital-scurf.org/
PGP mail accepted and encouraged.            Key Id: 3CCE BABE 206C 3B69