Time Invariant String Comparison
Jason A. Donenfeld
Jason at zx2c4.com
Thu Jan 16 12:44:53 CET 2014
Over at cgit  we use Lua for our authentication framework . One
thing we're doing wrong is lines like these:
if password == post["password"] then
Since an attacker can control the post params, this test is vulnerable
to a timing attack, by which an attacker could determine the password
one character at a time by analysis of response time.
What I'm looking for is some clever way in Lua to compare two strings
in a time invariant way. Any suggestions?
More information about the CGit