Key length comparison to fix ConstantTimeCompare quirk

alexedwards / argon2id

Argon2id password hashing and verification for Go

MIT License

467 stars 45 forks source link

Key length comparison to fix ConstantTimeCompare quirk #1

Closed darccio closed 5 years ago

darccio commented 5 years ago

According to this SO comment 1 and its attached source code, ConstantTimeCompare has a "subtle" behavior that could possible leak the length of compared data.

In order to fix this we should check both lengths using ConstantTimeEq.

alexedwards commented 5 years ago

Thanks for both the PR and the information, ConstantTimeEq was new to me :+1: