Page MenuHomePhabricator

Don't use "phutil_hashes_are_identical()" to compare public keys
ClosedPublic

Authored by epriestley on Oct 29 2019, 1:31 AM.
Tags
None
Referenced Files
F15544623: D20875.id.diff
Sat, Apr 26, 6:21 AM
F15543407: D20875.diff
Fri, Apr 25, 10:18 PM
F15540397: D20875.diff
Fri, Apr 25, 7:21 AM
F15475864: D20875.id49764.diff
Mon, Apr 7, 12:50 AM
F15468822: D20875.diff
Fri, Apr 4, 6:15 AM
F15436547: D20875.id49764.diff
Mar 25 2025, 3:04 PM
F15428635: D20875.id.diff
Mar 23 2025, 9:24 PM
F15425863: D20875.id49765.diff
Mar 23 2025, 6:29 AM
Subscribers
Tokens
"Y So Serious" token, awarded by leoluk.

Details

Summary

Ref T13436. There's no real security value to doing this comparison, it just wards off evil "security researchers" who get upset if you ever compare two strings with a non-constant-time algorithm.

In practice, SSH public keys are pretty long, pretty public, and have pretty similar lengths. This leads to a relatively large amount of work to do constant-time comparisons on them (we frequently can't abort early after identifying differing string length).

Test Plan

Ran bin/ssh-auth --sshd-key ... on secure with ~1K keys, saw runtime drop by ~50% (~400ms to ~200ms) with ===.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable