3 ms·
So then is the fix as simple as removing the early "break;" statement from a strcmp?
by snprbob86 16y ago
So then is the fix as simple as removing the early "break;" statement from a strcmp?
- Super_Jambo 16y agoPerhaps the fix is to comment it out and explain why. ;)
- amalcon 16y agoDepends on the rest of the strcmp implementation. You might still leak information such as the number of correct characters if responding to a correct character takes a different amount of time than responding to an incorrect character. Ever played Mastermind? Same theory here. Your best bet is to generate a huge body of inputs (including the relevant special cases), and tweak the code until it takes the same amount of time for all of them.
- NateLawson 16y agoNumber of chars would matter for plaintext passwords but not HMAC. You gain no more practical advantage knowing I used SHA1 or SHA256 HMAC. Yet another reason not to use plaintext passwords.