revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-25 16:22:43 +01:00
Code Issues Releases Wiki Activity

Don't use "phutil_hashes_are_identical()" to compare public keys

Browse source 
Summary:
Ref T13436. There's no real security value to doing this comparison, it just wards off evil "security researchers" who get upset if you ever compare two strings with a non-constant-time algorithm.

In practice, SSH public keys are pretty long, pretty public, and have pretty similar lengths. This leads to a relatively large amount of work to do constant-time comparisons on them (we frequently can't abort early after identifying differing string length).

Test Plan: Ran `bin/ssh-auth --sshd-key ...` on `secure` with ~1K keys, saw runtime drop by ~50% (~400ms to ~200ms) with `===`.

Maniphest Tasks: T13436

Differential Revision: https://secure.phabricator.com/D20875
This commit is contained in:
epriestley 2019-10-28 18:28:11 -07:00
parent 24f771c1bc
commit 4a53fc339e
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
scripts/ssh/ssh-auth.php
View file

@ -109,7 +109,7 @@ if ($authstruct === null) {
if ($sshd_key !== null) {
$matches = array();
foreach ($authstruct['keys'] as $key => $key_struct) {
if (phutil_hashes_are_identical($key_struct['key'], $sshd_key)) {
if ($key_struct['key'] === $sshd_key) {
$matches[$key] = $key_struct;
}
}