From: "Martin Boßlet" Date: 2012-05-29T14:42:43+09:00 Subject: Re: does this leak more than the size of the string via timing side channels --f46d04016b0381d25a04c1264de8 Content-Type: text/plain; charset=ISO-8859-1 On May 29, 2012 7:28 AM, "rooby shoez" wrote: > > Yes but I imagine that Ruby returns false on the first mismatch. So > > abcdefg > abcd1ab > > will return false when it compares f to a > > but > > 1abcef > 2acvbf > > will return false when it compares 1 to 2, so it leaks how many correct > bytes an attacker who can measure the time to compare the length has > guessed to the attacker. With Python this compare behavior has > apparently led to attacks against cryptographic systems that use it, and > from what I hear it is likely that Ruby also does not have a > cryptographically secure compare method. An easy way that works: Compute a secure hash of both arguments and compare that instead. Timing the hash won't reveal any information about the original arguments. -Martin --f46d04016b0381d25a04c1264de8 Content-Type: text/html; charset=ISO-8859-1


On May 29, 2012 7:28 AM, "rooby shoez" <lists@ruby-forum.com> wrote:
>
> Yes but I imagine that Ruby returns false on the first mismatch. So
>
> abcdefg
> abcd1ab
>
> will return false when it compares f to a
>
> but
>
> 1abcef
> 2acvbf
>
> will return false when it compares 1 to 2, so it leaks how many correct
> bytes an attacker who can measure the time to compare the length has
> guessed to the attacker. With Python this compare behavior has
> apparently led to attacks against cryptographic systems that use it, and
> from what I hear it is likely that Ruby also does not have a
> cryptographically secure compare method.

An easy way that works:

Compute a secure hash of both arguments and compare that instead. Timing the hash won't reveal any information about the original arguments.

-Martin

--f46d04016b0381d25a04c1264de8--