search

Jeff-Lewis / oauth-dot-net

Automatically exported from code.google.com/p/oauth-dot-net
0 stars 0 forks source link

Remote timing attack in HmacSha1SigningProvider #35

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
The HmacSha1SigningProvider is vulnerable to a remote timing attack in the way 
the signatures are compared. Comparison needs to be done in a manner that will 
take a constant amount of time regardless of success or failure. You can read 
more about timing attacks at http://codahale.com/a-lesson-in-timing-attacks/. 
I've attached a patch that passed all the unit tests on my end.

Original issue reported on code.google.com by jdow...@gmail.com on 12 Jul 2011 at 11:26

Attachments: