Fix side-channel in HMACSign<Hasher>::verify

arun11299 / cpp-jwt

JSON Web Token library for C++

MIT License

395 stars 111 forks source link

Fix side-channel in HMACSign<Hasher>::verify #101

Closed ErwanLegrand closed 9 months ago

ErwanLegrand commented 9 months ago

HMACSign::verify() introduces a side-channel which could possibly be exploited through timing attack. The issue is fixed by calling OpenSSL's contant-time comparison function, CRYPTO_memcmp().