Fix side-channel in HMACSign<Hasher>::verify

arun11299 / cpp-jwt

JSON Web Token library for C++

MIT License

387 stars 112 forks source link

Fix side-channel in HMACSign<Hasher>::verify #101

Closed ErwanLegrand closed 7 months ago

ErwanLegrand commented 7 months ago

HMACSign::verify() introduces a side-channel which could possibly be exploited through timing attack. The issue is fixed by calling OpenSSL's contant-time comparison function, CRYPTO_memcmp().