ahuston-0/hydra
1
0
Fork 0
Code Issues Pull Requests 1 Packages Projects Releases Wiki Activity

Passwords: check in constant time

Browse Source 
The default password comparison logic does not use
constant time validation. Switching to constant time
offers a meager improvement by removing a timing
oracle.

A prepatory step in moving to Argon2id password storage, since we'll need this change anyway after
for validating existing passwords.

Co-authored-by: Graham Christensen <graham@grahamc.com>
This commit is contained in:
Graham Christensen
2021-04-15 10:40:55 -04:00
committed by Graham Christensen
parent d4d8f1ba1b
commit 29620df85e
4 changed files with 53 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
flake.nix
View File

@ -229,6 +229,19 @@
license = with final.stdenv.lib.licenses; [ artistic1 ];
};
};
StringCompareConstantTime = final.buildPerlPackage {
pname = "String-Compare-ConstantTime";
version = "0.321";
src = final.fetchurl {
url = "mirror://cpan/authors/id/F/FR/FRACTAL/String-Compare-ConstantTime-0.321.tar.gz";
sha256 = "0b26ba2b121d8004425d4485d1d46f59001c83763aa26624dff6220d7735d7f7";
};
meta = {
description = "Timing side-channel protected string compare";
license = with final.lib.licenses; [ artistic1 gpl1Plus ];
};
};
};
hydra = with final; let
@ -279,6 +292,7 @@
SQLSplitStatement
SetScalar
Starman
StringCompareConstantTime
SysHostnameLong
TermSizeAny
TestMore