[#74190] [Ruby trunk Feature#12134] Comparison between `true` and `false` — duerst@...
SXNzdWUgIzEyMTM0IGhhcyBiZWVuIHVwZGF0ZWQgYnkgTWFydGluIETDvHJzdC4KCgpUc3V5b3No
3 messages
2016/03/07
[#74269] Type systems for Ruby — Rob Blanco <ml@...>
Dear ruby-core,
5 messages
2016/03/10
[#74395] [Ruby trunk Feature#12142] Hash tables with open addressing — shyouhei@...
Issue #12142 has been updated by Shyouhei Urabe.
3 messages
2016/03/17
[ruby-core:74087] [Ruby trunk Feature#10098] [PATCH] Timing-safe string comparison for OpenSSL::HMAC
From:
naruse@...
Date:
2016-03-02 03:41:19 UTC
List:
ruby-core #74087
Issue #10098 has been updated by Yui NARUSE. Assignee changed from openssl to Yukihiro Matsumoto ---------------------------------------- Feature #10098: [PATCH] Timing-safe string comparison for OpenSSL::HMAC https://bugs.ruby-lang.org/issues/10098#change-57234 * Author: Matt U * Status: Assigned * Priority: Normal * Assignee: Yukihiro Matsumoto ---------------------------------------- I could be totally wrong, but it seems the standard library doesn't provide a reliable way of comparing hashes in constant-time. * The docs for `OpenSSL::HMAC` encourage the use of `Digest#to_s` (see: http://ruby-doc.org/stdlib-2.1.0/libdoc/openssl/rdoc/OpenSSL/HMAC.html#method-c-new ) * Ruby's string comparison uses memcmp, which isn't timing safe (see: http://rxr.whitequark.org/mri/source/string.c#2382 ) With this patch I propose to add an additional method, `OpenSSL::HMAC#verify`, which takes a binary string with a digest and compares it against the computed hash. ---Files-------------------------------- hmac-timing.patch (2.5 KB) hmac-timing.patch (2.48 KB) tsafe_eql.patch (2.48 KB) tsafe_inline.patch (3.51 KB) 0001-add-timing-safe-string-compare-method.patch (4.31 KB) -- https://bugs.ruby-lang.org/ Unsubscribe: <mailto:[email protected]?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>