search

bdauvergne / python-oath

Python implementation of HOTP, TOTP and OCRA algorithms from OATH
BSD 3-Clause "New" or "Revised" License
128 stars 35 forks source link

Timing attacks? #8

Closed rudolphfroger closed 10 years ago

rudolphfroger commented 10 years ago

Shouldn't this library use something like Pythons hmac.compare_digest instead of the == operator to reduce the vulnerability to timing attacks? This applies to accept_totp, accept_hotp functions and probably also for the OCRA code.

bdauvergne commented 10 years ago

It would be great byt hmac.compare_digest is only available since python 2.7.7. in the meantime I think a pure python implementation of compare_digest would improve things

rudolphfroger commented 10 years ago

Thanks for implementing this!