From: "Dmitry S. Kravtsov" Date: 2012-05-29T14:54:51+09:00 Subject: Re: does this leak more than the size of the string via timing side channels --047d7b16308905125704c12679f3 Content-Type: text/plain; charset=UTF-8 Ok, now I get it, well I may only suggest to use high order functions, and write it like this: if computed_mac.length == presented_mac.length then computed_mac.chars.zip(presented_mac.chars).map {|x,y| x == y}.all? end 2012/5/29 rooby shoez > Yes but I imagine that Ruby returns false on the first mismatch. So > > abcdefg > abcd1ab > > will return false when it compares f to a > > but > > 1abcef > 2acvbf > > will return false when it compares 1 to 2, so it leaks how many correct > bytes an attacker who can measure the time to compare the length has > guessed to the attacker. With Python this compare behavior has > apparently led to attacks against cryptographic systems that use it, and > from what I hear it is likely that Ruby also does not have a > cryptographically secure compare method. > > The way I attempt to solve this in the above code examples, is by > comparing stings on a byte by byte basis but not returning true or false > until all bytes of each string have been compared. But are there other > timing variations I am missing in the examples? I was told that Ruby > probably can not do timing side channel secure compares of strings, but > I would like to confirm that here. > > -- > Posted via http://www.ruby-forum.com/. > > -- Dmitry S. Kravtsov --047d7b16308905125704c12679f3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Ok, now I get it,
well I may only suggest to use high order functions, = and write it like this:

if computed_mac.length =3D= =3D presented_mac.length then
=C2=A0 computed_mac.chars.zip(prese= nted_mac.chars).map {|x,y| x =3D=3D y}.all?
end

2012/5/29 rooby shoez <lists@ruby-forum.com>
Yes but I imagine that Ruby returns false on the first mismatch. So

abcdefg
abcd1ab

will return false when it compares f to a

but

1abcef
2acvbf

will return false when it compares 1 to 2, so it leaks how many correct
bytes an attacker who can measure the time to compare the length has
guessed to the attacker. With Python this compare behavior has
apparently led to attacks against cryptographic systems that use it, and from what I hear it is likely that Ruby also does not have a
cryptographically secure compare method.

The way I attempt to solve this in the above code examples, is by
comparing stings on a byte by byte basis but not returning true or false until all bytes of each string have been compared. But are there other
timing variations I am missing in the examples? I was told that Ruby
probably can not do timing side channel secure compares of strings, but
I would like to confirm that here.



--
= Dmitry S. Kravtsov
--047d7b16308905125704c12679f3--