Re: Time Invariant String Comparison

[Paige DePol <lual@...>]

On Jan 16, 2014, at 6:30 AM, Elias Barrionovo <elias.tandel@gmail.com> wrote:

> On Jan 16, 2014 9:55 AM, "Daniel Silverstone" <dsilvers@digital-scurf.org> wrote:
> > Lua's strings are interned and hashed.  As a result, string comparison for
> > equality is pretty much constant time :)
> 
> Unless it's Lua >= 5.2 and the password is really large, like >32 bytes large. But this can be changed at compile time.
> 
> =) 

40 bytes by default (check LUAI_MAXSHORTLEN in luaconf.h).

As for the password attack, wouldn't just adding a tiny random delay to each request negate such a problem?

Also, wouldn't this type of attack only work against servers with very little server load, given the delay between checking two characters of a string would be exceedingly tiny?

~pmd~