Repository navigation
Timing vulnerability? #42
Description
I've been working on implementing bcrypt-ruby and have been reading about timing attacks, particularly your article here:
http://codahale.com/a-lesson-in-timing-attacks/
I notice that Devise (popular gem that uses bcrypt-ruby) implements a constant-time comparison algorithm in conjunction with bcrypt-ruby:
https://github.com/plataformatec/devise/blob/master/lib/devise.rb#L424
I also notice that bcrypt-ruby's BCrypt class inherits from Ruby's String class, and the BCrypt#== method simply calls up to super, thus comparing strings using Ruby's String#== method, which I assume is not a constant-time comparison algorithm.
Should BCrypt handle this constant time issue in it's comparison method?
Activity
codahale commentedon Jul 18, 2012
No. One of the desired properties of a cryptographic hash function is preimage attack resistance, which means there is no shortcut for generating a message which, when hashed, produces a specific digest.
Finding a first-preimage attack for bcrypt would be surprising, to say the least.
waiting-for-dev commentedon May 6, 2015
Hey, I have been worried recently about this issue. I understand the reason why it is not needed, but it seems that other language implementations like
timingsafe_bcmp.cinpy-bcryptorpassword_verify()in PHP use constant time functions, following defence in depth policy.I just took this information from a post in security stackexchange:
What do you think about it?
tjschuck commentedon May 6, 2015
@waiting-for-dev See #43 for much more information about why this is unnecessary.
Regarding "defense in depth" for this specific issue, @codahale said it best on #43:
waiting-for-dev commentedon May 6, 2015
Ok, thanks for pointing me there :)
codahale commentedon May 6, 2015
To be clear, I’ve personally softened my position since then. I don’t think using a constant-time comparison function adds any actual security, but if it makes people feel better (and therefore more likely to use bcrypt instead of rolling their own), the cost isn’t particularly high.
I’m not maintaining the codebase, however, so I’ll defer to those who would actually bear that cost.