search

crystal-community / jwt

JWT implementation in Crystal
MIT License
206 stars 24 forks source link

Use constant time string comparison #31

Closed jamescook closed 4 years ago

jamescook commented 4 years ago

Both of the popular Ruby and Go JWT implementations use constant-time string comparisons to some extent. Both use constant time comparison of a HMAC signature, but only Go uses constant time comparison for the 'aud' and 'iss'.

jamescook commented 4 years ago

@veelenga The general use case is to prevent timing attacks on HMAC signatures. In terms of tests, there is already coverage around signature and claim verification. Is there a test you can think of that needs to be added?

veelenga commented 4 years ago

@jamescook I see, thanks. Well, I just try to follow the rule that every change should be enforced by the test, otherwise, if someone accidentally (or intensionally) changes it back, the suite will pass and there will not be any reason not to merge that as well.

However, I would rely on @stakach's input here.