3 ms·
memcmp does a binary level comparison of data. On many versions, memcmp will return exactly when it sees a difference between the two buffers. Because it retur
by Moral_ 13y ago
memcmp does a binary level comparison of data.
On many versions, memcmp will return exactly when it sees a difference between the two buffers. Because it returns immediately one can figure out what byte it failed at due to timing and construct the correct input.
Some others have pointed out that it's a static function, which I stupidly overlooked. Others have pointed out it's not really used anymore so the title doesn't accurately reflect the issue. -- I will probably delete this thread.
- pipeep 13y agoIt wasn't static for older versions of OpenSSL, so this still might be an issue if someone was using that function with the assumption of it being constant-time.