From: "Martin Boßlet" <martin.bosslet@...>
Date: 2012-05-29T17:51:33+09:00
Subject: Re: does this leak more than the size of the string via timing side channels

2012/5/29 Dmitry S. Kravtsov <idkravitz@gmail.com>:
> Ok, now I get it,
> well I may only suggest to use high order functions, and write it like this:
>
> if computed_mac.length == presented_mac.length then
>   computed_mac.chars.zip(presented_mac.chars).map {|x,y| x == y}.all?
> end
>

all? will be most likely short-circuiting, too, so this has the same
problem as using ==.

There's two ways I know that security folks have approved of:

1. As it is done in eql_time_cmp in [1].

2. sha = OpenSSL::Digest::SHA256.new
    if sha.digest(computed_mac) == sha.digest(presented_mac)
      ..
    end

Although some say that there is even a problem with the first method:
An extremely
optimized (byte code) compiler could figure out what we're trying to
do there and "help"
us in short-circuiting again. This won't apply to the second method, though.


[1] http://www.ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL/PKCS5.html