search

rchouinard / phpass

PHP Password Library: Easy, secure password management for PHP
http://rchouinard.github.com/phpass/
MIT License
246 stars 28 forks source link

Remote Timing Attack vulnerability #4

Closed sstok closed 12 years ago

sstok commented 12 years ago

Comparing passwords using == or === is vulnerable to a remote timing attack. http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote-timing-attacks-on-php-applications-time-to-take-them-seriously/

rchouinard commented 12 years ago

I've looked into this previously, and all my research indicates that this is unnecessary when dealing with proper password hashing techniques. Even the article you link states, "Using one-way hashing should defeat this because it’s very hard to work backwards from timing leaks when the attacker derived input keeps changing (hashes to a different digest each time a byte changes in the original plaintext input)."

I'll be happy to look into this again, but these issues are related more to accidental data disclosure than brute-force password cracking when hashes are in use.

sstok commented 12 years ago

OK, no problem. Keep up the good work.