Page MenuHomePhabricator

Don't use "phutil_hashes_are_identical()" to compare public keys
ClosedPublic

Authored by epriestley on Oct 29 2019, 1:31 AM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Mar 1, 5:41 AM
Unknown Object (File)
Feb 21 2024, 2:05 PM
Unknown Object (File)
Feb 18 2024, 8:36 PM
Unknown Object (File)
Feb 7 2024, 2:37 PM
Unknown Object (File)
Feb 3 2024, 11:22 PM
Unknown Object (File)
Feb 3 2024, 11:22 PM
Unknown Object (File)
Feb 3 2024, 11:22 PM
Unknown Object (File)
Jan 22 2024, 9:49 AM
Subscribers
Tokens
"Y So Serious" token, awarded by leoluk.

Details

Summary

Ref T13436. There's no real security value to doing this comparison, it just wards off evil "security researchers" who get upset if you ever compare two strings with a non-constant-time algorithm.

In practice, SSH public keys are pretty long, pretty public, and have pretty similar lengths. This leads to a relatively large amount of work to do constant-time comparisons on them (we frequently can't abort early after identifying differing string length).

Test Plan

Ran bin/ssh-auth --sshd-key ... on secure with ~1K keys, saw runtime drop by ~50% (~400ms to ~200ms) with ===.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable